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SUMMARY 

Several new areas in aerospace structural reliability were investigated. 
The investigations were directed toward the development of a methodology for 
selecting a combination of structural tests and structural design factors for 
aerospace systems on the basis of optimized expected cost. The optimization 
method involves the use of Bayesian statistics and statistical decision theory 
as exemplified by the work of Pratt, Raiffa, and Schlaifer of the Harvard 
School of Business Administration. 

From the basic theory, a specific model applicable to the problem of 
selecting structural tests and design factors was developed. This was accom- 
plished by establishing the decision to be made as a selection of a test method 
from four alternatives or options and the selection of a design factor from a 
continuous spectrum. The strength of the structure and the loads applied to the 
structure were assumed to be random variables that influence the decision. 

The decision criterion was minimum expected cost, where probabilistic as well 
as deterministic costs were considered. 

Probabilistic strength distributions needed in the decision model 
required new developments. Subjective expert opinion, obtained through mail 
questionnaires, was used to obtain a strength distribution for a test option 
where observed duia. were not available. The method of acquiring opinions and 
ike probabilistic models used in the analysis of the opinions were first verified 
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by a test questionnaire which gave results that could be compared with observed 
data. 

A technique employing Bayesian statistics was used to incorporate new 
information with prior data in obtaining another strength distribution. Labora- 
tory test results were used to obtain a prior distribution, and flight data were 
used as new information for revising the prior distribution . 

The methodology developed was applied to several typical aerospace 
structures to illustrate the effect of system characteristics such as value of 
weight, cost of failure, and cost of testing on the optimum decision. From the 
example problem results, it was concluded that the method provides a reason- 
able means of selecting tests and design factors for aerospace structures . 
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CHAPTER I 
INTRODUCTION 
1. 1 Orga nization of Material 

The research will be introduced by a brief discussion of some background 
concepts required for understanding the remainder of the work. Following this, 
since the research falls into the broad category of aerospace structural reliabil- 
ity, a review of the literature in this area is given. 

In light of this review of previous work, a statement of the research 
problem and the various topics composing the problem is presented in Chapter 
HI, followed by an overview of the method of solution. 

The three major original contributions of the research and several other 
contributing innovations are presented in Chapters IV through VII. The analysis 
method developed is then applied to several structural assemblies of NASA space 
vehicles in Chapter vm to illustrate the technique and to show how the system 
characteristics of the various assemblies affect the outcome. 

Some results and conclusions from the research are discussed in Chapter 
IX. Recommendations, particularly in the area of possible further research, 
are also given in that chapter. Nomenclature for the entire dissertation is given 


in Appendix A. 



4 


1.2 Background 

On the following pages certain concepts which are essential to further 
development of the research are briefly outline’. In most cases, the concepts 
discussed here have developed into common usage and only typical references, 
usually not to the original contributor, are cit~d. The references mentioned 
generally give a coherent discussion of the idea under consideration, as applica- 
ble to the present research. 

1.2.1 Reliability 

Tribus [ 1] credits the National Aeronautics and Space Administration 
with the following definition of reliability: the probability of a device perform- 
ing adequately for the period of time intended under the operating conditions 
encountered. Some key words and phrases in this definition require careful 
interpretation in the light of each problem. 

Benjamin and Cornell [ 2] discuss probability as the relative frequency 
of occurrence of an event in repeated trials or, more liberally, as an 
individual T s measure of the relative likelihoods of the possible outcomes of an 
experiment. Many have argued, including Tribus tl] and McGee [3] , that the 
individuals belief about the relative likelihood or plausibility of an event is the 
appropriate concept of probability and that the relative frequency interpretation 
is only a special case of this more liberal interpretation. For example, if there 
is to be only one launch of a particular type of spacecraft, there is no such thing 
as a long-run relative frequency in connection with the probability of success. 

The single mission will either succeed or fail. Given information about the 
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spacecraft, one might assign a number between 0 and 1 as a plausibility 
(probability) measure that the mission will be a success. Note that such a 
plausibility measure can include cases where relative frequency is meaningful. 

It is this concept of probability as a plausibility measure that will be used in 
this research. 

In the reliability context there are two possible events or outcomes — 
success and failure. Thus, reliability becomes the decision-maker T s assess- 
ment of the probability or plausibility of success. Since success and failure are 
prescribed to be the only possible outcomes, the following relationship results 
from an axiom of probability as given by Benjamin and Cornell [ 2] : 

P p + L = 1 (1.1) 

or 

P F = 1 - L , 

where P is the probability of failure and L is the reliability or probability 
F 

of success. In this research, probability of failure will be a frequently used 
idea with the understanding that the corresponding reliability is readily obtain- 
able from equation ( 1. 1) . 

Device is the next word in the definition to be discussed and is the 
identification of the article, component, or system for which the reliability is 
being discussed. The device could range from a single simple tension member, 
to a complete airframe , to an entire fleet of airplanes . 
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The period of time intended and the operating conditi ons encountered 
must also be clearly stated. These conditions of operation could range from 
withstanding a single prescribed application of load to survival of all expected 
conditions in a complete airplane service life. 

A precise description of adequate performance is equally important; 
otherwise, reliability is an ambiguous term. In some situations, the appearence 
of any defect requiring repair would be termed inadequate performance. In 
other instances, only a catastrophic loss of the system is of interest. 

It should be noted that these assertions of the device under consideration, 
the overall conditions of operation, and the description of adequate performance 
should be specified in deterministic form as a prelude to calculating the 
probabilistic quantity, reliability. 

A misunderstanding of any of these assertions can cause a difference in 
reliability of several orders of magnitude. Of course, more detailed probabil- 
istic requirements are derived from the specified deterministic requirements 
in calculating reliability. 

1.2.2 Resistance and Load 

Two generally accepted and understood ideas of structural reliability 
discussions are the concepts of resistance and load, under various names. 

Names often used for resistance are strength, capacity, and capability. Terms 
used for load are stress, strain, and demand. Generally speaking, the load is 
a measure of the environment acting on the system, and the resistance is a 


measure of the ability of the system to withstand the environment. 
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Frequently, though not always, the load represents effects not under the 
immediate control of the designer, and resistance is visualized as a quality to 
be determined by the designer; that is, the designer is to select a design which 
has a resistance sufficient to withstand the load. For example, the designer may 
be required to select a structural design with sufficient static strength to with- 
stand a given static or quasi-static load. As another example, a design may be 
required to have fatigue capability (resistance) to withstand a particular stress 
for a given number of cycles. Very simple relationships can be used to denote a 
satisfactory design, as 

R > S , orR-S^O , or J s 1 , (1.2) 

where R is resistance and S is load. Such relationships are discussed in 
numerous publications. For example, see Asplund [4] , Brewer [ 5] , Brown f 6 ] , 
Chilver [ 7] , Disney, Upson, and Sheth [ 8] , Freudenthal [ 9] , or Su [ 10] . 

Complexities arise in the satisfaction of the inequalities of equation 
(1.2) because of uncertainties in the resistance and load. These uncertainties 
stem from two basic sources. First, there is a natural or intrinsic uncertainty 
because loads and resistances are probabilistic phenomena. Second, the engi- 
neer cannot precisely describe the phenomena. Uncertainties can also be 
classified as objective (those that can be expressed in terms of measured data) 
and subjective (those that cannot be or have not been measured and depend on 
personal assessment) . Uncertainty dictates that a completely rational descrip- 
tion of the design adequacy cannot be expressed by equations (l. 2) but requires 
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probability statements about the inequalities in (1.2). Giv^u sufficient infor- 
mation about R and S, the engineer may make the following statements, 

P[R s: S] = a , or P[R - S a: 0] = a , or P[§ > 1] = a , (1.3) 

s 

where the first statement, for example, is read, "the probability that R is 
greater than or equal to S is a." If R and S are defined appropriately, then 
a = L, the reliability. 

1.2.3 Safety Measures 

In this discussion of safety measures, resistance R and load S are 
assumed to be described in terms of statistical parameters, R (mean resist- 
ance) , S (mean load), <r ( standard deviation of resistance) , and a 
(standard deviation of load) . 

The term "safety measure" as used in the heading of this section means 
any parameter devised to provide a safety increment between load and resistance. 
Safety factors, safety margins, and safety indices are safety measures to be 
discussed in this section. A number of commonly used safety measures are 
discussed by Kececioglu and Haugen [11] . Any safety measure can be regarded 
as either a prescribed constant which controls or specifies the design or as a 
variable which describes the status of the design. These are actually two 
distinct concepts with subtle differences, and this has caused a considerable 
degree of difficulty in communication. The two concepts will be discussed in 
the following paragraphs in terms of the safety measure known as the safety 
factor. The safety factor can be expressed as follows: 
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where v is the safety factor. Ia the first concept, this factor is perceived as a 
design requirement or design specification and the interpretation would be, M It is 
required that the resistance-to-load ratio be v. f1 It is evident that v is a 
constant in this case, and the equation is ambiguous unless particular values of 
R and S such as R and S are used in the equation. In this case, v is called 

o 

the mean or central safety factor and could be appropriately labeled as v. Other 
values of R and S could be used in the specification. For example. 


R ~ P °R 

s + qff s 


s 

q 


(1.5) 


where p and q are constants, has frequently been used. In this dissertation a 
superscript " "a", or other identification will always be used to distinguish 

the specified safety factor, and the term, design safety factor, will be used in 
the text. 

In the second concept, the safety factor is a property of the design. 
Equation (1.4) would be interpreted as ! The ratio of resistance to load is v." 
Thus, v is a variable for the second concept, which describes the status of the 
design. If R and S are random variables, v is also a random variable, and 
equation (1.4) can be substituted into (1.3) to yield. 


J?[v > 1] = a = L 


( 1 . 6 ) 
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which directly relates the safety factor to the reliability. 

Another frequently used safety measure is safety margin. Two different 
definitions of safety margin are as follows: 

SM = R - S (1.7) 


and 



Through equation (1.3) , the reliability can be calculated directly from definition 
(1.7) as 

L = P[R - S s 0] = P [SM == 0] . (1.9) 


Equation (1.8) is used extensively in the aerospace industry and gives the 
fraction by which the design resistance exceeds the requirement. 

The safety index provides another means of specifying or calculating 
structural reliability. Its definition is 


P = 




( 1 . 10 ) 


The safety index will be used extensively in this research. It is a relatively new 
concept which was mentioned by Corso in a discussion of Freudenthal’s paper 
[ 12] . The concept has been used by Blake [ 13] , and Mau and Sexsmith [ 14] . 



11 


Cornell [15] suggested its use in a structural code. 

It should be mentioned that in any given situation it would be possible to 
apply any one of the preceding safety measures. The primary factors to be 
considered in selecting the safety measure to be used are convenience and 
communication. The convenience is usually computational. For example, if 
resistance and strength are normally distributed random variables, then 
R - S is also normally distributed. This could well lead one to utilize the 
safety margin or safety index for normally distributed R and S. Communica- 
tion is a tremendously important aspect which is frequently overlooked. It is 
unlikely that a new research idea will gain widespread acceptance unless the 
results are eventually cast in some form easily recognizable to practitioners 
in the field. This could lead to use of a well-known safety measure or at 
least to a demonstration of how the safety measure used relates to a familiar 
measure such as the safety factor recognized by most structural engineers . 
1.2.4 Structural Testing 

A brief explanation of structural testing will be given here to place it 
in proper context with respect to this dissertation. Small-scale static and 
fatigue tests on specially designed specimens to determine basic material 
properties could properly be called structural tests. However, the kind of 
testing considered here is on a much larger scale. The concern here is with 
the testing of large structural assemblies which make up an airframe, or even 
the testing of the complete airframe itself. This is the type of testing discussed 


L 
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by Lowndes and Cavanagh [16] , Thorns^ j'?], and Kosenfield [18], which will 
be described as the "baseline" teeing. 

In most airplanes or aerospace systems, all structural assemblies of 
the airframe have been tested in the laboratory, either as separate units or 
as a complete assembly. Both methods have been successful. If the assemblies 
are tested separately, care must be taken to simulate the boundary conditions 
where the tested structure joins the remainder of the airframe. Because of 
various practical considerations, testing by assemblies has the advantage of 
providing for more refined application of loads and more densely distributed 
instrumentation. If the complete airframe is tested, larger facilities are 
required, loading is less refined, and instrumentation is more sparse. How- 
ever, the important boundary condition problem is eliminated. 

Ideally, the testing discussed above is accomplished on an airframe 
built from the same specifications and under the same conditions as the actual 
flight articles. Often, there are compromises in this respect. 

Studies have been made to determine the need for such testing. These 
studies have revealed a failure rate ranging from 32 percent to 65 percent in 
this type of testing; that is , approximately one-third to two-thirds of the test 
articles experience some type of failure at less than predicted failure load, 
as shown by Bouton and Trent [19] , Jablecki [20] , and Thomas [17] . There 
can be no doubt that full-scale structural testing has been an effective "error 
discloser" as discussed by Bouton and Trent [ 19] . 
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Nevertheless, the increasing size of airplane and aerospace structural 
systems and the complexity of environments such as temperatures applied to 
the systems have encouraged a search for other means of assuring structural 
reliability. Lowndes and Cavanagh [16] discuss facility and operational costs 
in testing large high-temperature systems and show that costs could be an 
order of magnitude higher than previous costs for lower temperatures . 

Other methods of testing have been used to some extent, usually as a 
supplement to the testing discussed above. These include model tests (a 
scaling down of the test article size) , component tests (the testing of individual 
small subassemblies which make up the major assembly) , and proof tests 
(the pretesting of each actual flight assembly) . These alternative types of 
tests will be expanded in scope and considered as options which could be used 
in place of the "baseline" type of testing previously discussed. 

1 . 2 . 5 Relationship of Safety Measures. Testing, and Cost 

Alternatives to the "baseline" type of testing appear more plausible if 
studied in conjunction with safety measures and cost. To gain an understanding 
of the relationships involved, consider some extreme examples. As a first 
example, assume that the design safety measure has been set at a very high 
value so that even if errors exist in the analysis, failure is unlikely. Then 
there is no need for testing, and the test cost has been saved with perhaps no 
decrease in reliability and no increase in maintenance cost. However, the 
large safety measure is certain to cause weight increases which could perhaps 
be tolerated in some systems but not in others. 
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As a second example, assume that testing of not one but several com- 
plete airframes identical to the flight article is planned and that design changes 
will be made on all flight articles to correct any deficiencies observed during 
testing. This gives a high assurance that fewer errors will remain in the 
design or manufacturing after the test program has been completed. Then the 
design safety measure used in the initial design could be much lower, again, 
with no decrease in reliability and no increase in maintenance cost, but with 
the attendant lower weight and increased performance. It is quite possible 
that this increased performance could be well worth the increased test cost in 
some systems. 

Although the baseline method of testing has usually produced acceptably 
reliable systems, there is certainly no proof that it is the best method for all 
systems. Alternative methods deserve careful study. 

1.2.6 Decision Theory 

Statistical decision theory, as exemplified by Pratt, Raiffa, and 
Schlaifer [21] , provides an excellent means of studying the complex inter- 
relationships discussed above in a quantitative manner. A lengthy discussion 
would be required to present even a rudimentary development of decision 
theory. Instead of embarking on such a development, we will devote this 
section to describing what can be done with the theory. 

Statistical decision theory is one technique which provides a mathe- 
matical model for making decisions in the face of uncertainty. For example, 
the fact that uncertainties exist in loads and resistance has already been 


discussed, yet a decision may be required on what design safety factor to 
specify. 

The decision-making process is formulated as the process of choosing 
an action , a, from among the available alternative actions, a^ , the 
members of the action space, A. For each possible action the true state of 
nature will yield a certain value, a measure of the consequences of the action. 
For example, the action could be the choice of design safety factor, the state 
of nature could be the reliability and system weight achieved, and the value 
could be the total tonnage of goods deliverable by a fleet of airplanes . 

If the true state of nature were known with certainty, one would readily 
calculate the value of each alternative action and select the action with highest 
value. Statistical decision theory provides a method of determining the action 
with the highest expected value when the true state of nature is not known with 
certainty, but probabilistic information is available about the state of nature 
or its constituents. 

Further, if Bayesian statistical methods are used, the probabilistic 
information can be in the form of observed data or of the engineer's subjective 
degree of belief. One distinct advantage of the Bayesian approach is that 
experimental data can be combined with the prior information available . It is 
required only that the resulting probabilities represent the relative likelihoods 
upon which the individual is prepared to base his decision. 

The decision methodology also provides for selecting an experiment 
(or no experiment) from among several candidates which achieves the best 




balance between experiment cost and reduced risk in the action choice. Through 
Bayes* theorem a means is provided for incorporating new data with existing 
data to update probability estimates . 


II 
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CHAPTER H 

REVIEW OF THE LITERATURE 
2. 1 Scope of Li terature Review 

The scope of the present research extends into several areas, such as 
probability, statistics, decision theory, and testing. However, the major 
motivation for the work and the primary thrust of the research is directed 
toward the reliability of aerospace structures . Since it would not be feasible 
to attempt a reasonably complete literature review in all of the areas 
mentioned above, it seems appropriate to concentrate on the area of primary 
emphasis, aerospace structural reliability. 

In some respects, a broad view of the topic of structural reliability is 
included. For example, literature in the field of structural criteria such as 
safety measures is included, whether or not the safety measure is related by 
the author to structural reliability. Also, a number of publications outside 
of the aerospace field, particularly in the area of civil engineering structures 
where a great deal of closely related work has been done, are included if the 
techniques presented can be applied directly to aerospace structures . In other 
respects, the review is restricted to a narrower viewpoint. For example, 
although several important articles on fatigue are included, the review in this 
area is by no means complete, because the present research was restricted 
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to the static strength of structures. For the same reason, material on struc- 
tural loads is included only as required to make the material on structural 
strength more meaningful . 

The review is conducted in essentially a chronological order. Excep- 
tions to this are made when a grouping of several articles in a closely related 
area improves the continuity of the presentation. The primary purpose of the 
review is to simply relate what was done in each publication, but evaluative 
remarks are sometimes made in relating the’ publication to the present 
research. 


2. 2 Historical Observations 

According to Bouton and Trent [19] , the concept of the structural safety 
factor for aircraft dates back to the Wright Flyer, when the Wright brothers 
established as their objective a structural system that would sustain five times 
the weight of the vehicle. It would appear that such a goal may have been some- 
what arbitrary and that some rational, quantitative basis for selecting safety 
factors is desirable, but to this date no widely accepted quantitative means of 
selecting structural safety factors has appeared in the aerospace industry. 

In spite of attempts by some engineers to introduce rational means of safety 
factor selection, usually on the basis of reliability analysis, safety factors 
are still arbitrarily selected in many cases , and the particular values are 
based on precedent and tradition. 

In general , such an approach has produced acceptably reliable 
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structural systems in the past; hence, there has been a great reluctance to 
change the approach. Nevertheless, it has certainly not been proved that no 
better method of selecting safety factors can be devised. It is highly probable 
that some alternate method could produce equally reliable structures with 
better performance and at lower cost, or possibly, more reliable structures 
with equal performance and cost. 

The phrase safety factor could refer to any parameter used to control 
the strength of a structure relative to the applied load. However, since the 
term "safety factor" has acquired a more specific meaning, the term "safety 
measure" will be used to refer to such parameters as discussed in Chapter I. 

2 0 3 Contents of the Literature 

Tye [22] suggested in 1944 that aircraft performance envelopes, 
rather than arbitrary factors, be used to establish yield strength and ultimate 
strength requirements . For example , the ultimate condition could be specified 
as one which occurs once in 100, 000 hours and the yield condition one which 
occurs once in 100 hours. It was argued that arbitrary factors sometimes 
resulted in physically impossible load conditions. The paper contains 
examples of typical safety factors in use in the 1940 T s. Evidently, this was a 
transition period in which the yield factor was changing from 1 . 5 or 1 . 25 to 
1.125 and the ultimate factor from 2. 0 to 1.5. 

In 1947 Freudenthal published one of his classic papers [23] con- 
taining many fundamental concepts of reliability analysis. The safety factor 
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is defined as the ratio of the random variable resistance to the random variable 
load, rather than the ratio of a "minimum" resistance to a "maximum" load. 
Several topics such as superposition of influences, types of loads, temperature 
effects, wind forces, boundary conditions, material properties, and uncertainty 
in dimensions were discussed in analytical form. 

Chilver [7] showed that the frequency of structural failure could be 
calculated by integrating either over increments in the strength of the structure, 
considering the load fixed, or over increments in load considering the strength 
fixed in each increment. These relationships were shown as sums over 
discrete increments and in integral form. Pugsley [24] discussed several 
items affecting structural safety, including fatigue, random loading, and 
corrosion effects . The probabilistic effects of strength and loading were 
considered, and the effect of safety factor on the probability of failure was 
shown graphically. A trend toward reducing the reliability problem to one of 
economics was discussed, and a simple cost minimization model, in which 
initial cost and cost of failure were considered, was presented. 

In a 1955 doctoral thesis [20] JableckL presented the results of 
static load testing of a large number of aircraft major components. Roughly 
one-half of the components failed at less than design ultimate load. The 
report seems to substantiate the fact that static testing is essential for air- 
craft structures designed with small safety factors . The link of safety factors 
to the amount of testing needed has received little attention, in general. The 
publication is a valuable source of information on structural failures, and in 
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many cases, the location and cause of failure were given. Unfortunately, 
strength values of structures sustaining greater than design ultimate load were 
not given, and a strength distribution cannot be developed from the data. It is 
noteworthy that, regardless of the component, almost all failures occurred in 
some type of joint, fitting, cutouts, or some other type of load transition area. 

A general review of the role of safety factors in aircraft structural 
safety was given by Williams [25] . The importance of the ultimate strength 
test in demonstrating that an aircraft can survive greater than limit load was 
stressed. Williams visualized the ultimate safety factor as an assurance that 
the few aircraft in a fleet which might encounter excessive loads will survive . 
The fatigue or life factor assures that each individual aircraft in the fleet will 
sustain the required load repetitions . 

Freudenthal published a handbook-type exposition on structural 
safety [12] in 1956. The relationship of economics to reliability was intro- 
duced. Analytical relationships among several safety measures, statistical 
distributions, and the probability of failure were given. In discussions of the 
paper, the safety index (unnamed at the time) and additional ways to compute 
the probability of failure were introduced. Asplund [4] exploited the idea that 
some risk is unavoidable in design and related this risk to mortality and the 
efficient use of resources. 

A progress report of an ASCE committee on factors of safety [ 26] 
was written by Chairman O.G. Julian in 1957. The committee recommended 
the use of two separate factors: a factor of safety and a factor of serviceability. 
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The factor of safety was defined as the ratio of mean collapse resistance to the 
mean load and was to assure a sufficiently high probability that the structure 
would not collapse. The factor of serviceability is a similar ratio, but with 
respect to serviceability rather than collapse. Nomograms and tables were 
given for determining probability of failure versus safety factor for normal 
a iid log-normal load and strength distributions. 

In Part I of a United States Air Force Report 1 27] , Landes, Wagner, 
and Kriegshauser reviewed the structural requirements and characteristics of 
several missile systems with the goal of developing design criteria on a 
reliability basis. Because of the lack of data to implement such criteria, they 
recommended, on an interim basis, that separate factors be applied to speed, 
quality, and maneuverability instead of applying a single safety factor to 
loads. In Part II of the report [28] , Ready developed a framework for 
establishing design requirements to achieve a given level of reliability. The 
methodology deals almost entirely with load variability with little attention to 
strength variability. Because of an attempt to make the method all-inclusive, 
it appears very difficult to understand and to use . The report also contains 
some questionable assumptions in the area of probability and statistics. 
Nevertheless, it is the first attempt to develop structural criteria adaptable 
to very complex environmental conditions . 

Su [10] , Brown [6] , and Svensson [29] discussed means of combining 
the variability of several effects such as strength , loads , dimensions , and 
environments to obtain a single safety factor. For example, Brown combined 
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a factor on loads, a factor on strength, and a factor on social consequences 
into a single safety factor to be multiplied by a characteristic load value to 
establish a characteristic strength value. 

Although a few authors had mentioned the possibility of optimizing 
reliability toward some desired goal such as minimum costs, it appears that 
Hilton and Feigen contributed the first analytical structural optimization 
problem in reliability [30] . Their problem was to minimize the weight of a 
structure for a preassigned probability of failure. To accomplish this, 
Gaussian distributions for loads and strength were assumed. The weight of 
the structure and the probability of failure were both expressed as functions of 
the member areas , and the problem was formulated as a minimization of the 
member weights with the prescribed probability of failure as a constraint. It 
was shown that the heavier structural members should be assigned relatively 
higher individual failure probabilities to achieve minimum weight. 

Freudenthal [ 9] published a method for calculating reliability when 
the combined effects of fatigue and ultimate failure are considered. The 
reliability was expressed as a function of the life of the structure in terms 
of the number of load repetitions for both fatigue and ultimate failure. By 
assuming independence of the two failure modes, the combined probability of 
failure was obtained by adding the two contributions . The probability of 
ultimate failure was considered constant over the life, but the probability of 
fatigue failure increased with the number of load repetitions. Freudenthal 


recognized that the assumption of independence of the failure modes may not 
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hold in many cases , since a fatigue-damaged structure is more susceptible to 
ultimate load failure. However, if the dependence of the failure modes is 
recognized in the analysis, ultimate strength data on fatigue -damaged struc- 
tures are required in the analysis, and these data are not normally available. 

Structural reliability as a probabilistic phenomenon was discussed 
by Bouton 1 31] , who pointed out that the probability of survival is an 
appropriate quantitative measure of reliability. The conflict of influences 
tending to increase reliability (economics of failure of the system) and 
influences tending to decrease reliability (system weight) were recognized. 

The author indicated that the selection of an appropriate reliability is primarily 
economic in nature but considered the analysis required to perform such a cost 
optimization impractical at that time . The effect of variability in loads and 
strength on reliability was discussed, and the results of some example 
problems were shown, but the method of calculation was not given. A flow 
chart showing the various factors that influence component strength and the 
environment of the component, and hence determine the reliability, was 
developed. 

A unique method of characterizing loading was given by Leve [32] 

In this method, the loading is characterized by a set of deterministic life 
histories , and the reliability over an individual life history is the minimum 
value attained along the history . The total reliability is obtained by summing 
the products of the individual reliabilities and their probability of occurrence. 

It was also shown in this paper that an assumption of independence of failure 
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of individual members is invalid if the loading in the members is not independ- 
ent. Techniques for apportioning reliability were also discussed, and a 
modification of the Hilton-Feigen model [30] was suggested, which accounts 
for dependence of the failure modes . 

The reliability analysis and allocation methods advocated by Leve 
hinge on the idea that there are only a few predominant failure modes in a 
complex structure and that other failure modes, less likely to occur, are 
associated with these predominant modes. Only the predominant modes are 
assumed independent. The result of such an approach is that the overall 
reliability goal for a structure can be achieved with lower individual member 
reliabilities, yielding a lower structural weight than an assumption of inde- 
pendence of all failure modes. The problem with such an approach appears 
to be that the predominant failure modes must be known a priori, whereas in 
many instances oversights or errors by the designer is a major contributor 
to unreliability as discussed by Bouton and Trent [19] . 

Possible alternatives in testing large airframes were discussed by 
Lowndes and Cavanagh [16] . The rapidly escalating cost of full-scale testing, 
primarily due to more severe thermal environments, was discussed. The 
continued need for full-scale testing was substantiated by data which showed 
that failures occurred in many static test programs of aircraft between 1 940 
and 1963. The authors pointed out that testing is effective in determining 
manufacturing effects , determining analytical deficiencies , and disclosing 


human errors. 
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Four alternative methods of testing were reviewed with regard to 
their effectiveness in performing the above functions. These are ( 1) loading 
the entire vehicle but heating only local areas , ( 2) separating into components 
and heating and testing each separately, (3) testing to higher than flight loads 
with lower than flight temperatures, and (4) model testing. No conclusion 
was reached as to the best alternative . It should be mentioned that component 
testing was successfully used by the National Aeronautics and Space Adminis- 
tration in the Saturn program as discussed by Thomas [17] . The problem of 
boundary conditions where the test component joins the rest of the airframe 
was usually overcome by building a test fixture with stiffness to simulate 
the adjoining structure or actually using a part of the adjoining structure as 
part of the test fixture. 

A linear-perturbation method of reliability estimation and weight 
optimization was published by Broding, Diederich, and Parker [33], Relia- 
bility was related to safety factor by assuming that the safety factor is a 
normally distributed random variable. In the linear perturbation method, 
weight and safety factor are expressed as linear functions of the design 
variables through a Taylor series expansion about some reference values in 
the range of interest. The weight is then minimized with respect to each 
design variable such as strength or thickness, with a probability of failure 
for each mode of failure as constraints . The authors stated that the approach 
could be extended to the case of a prescribed overall reliability. The method 
appears to be useful when the interest is in optimizing on several design 



27 


variables and safety factor and weight are approximately linear functions of 
the design variables in the range of interest. In an example problem, tempera- 
ture, allowable strain, coefficient of thermal expansion, and elastic modulus 
are treated as design variables . 

Switzky [ 34] produced an analysis procedure for minimizing weight 
of components with a constraint on the overall probability of failure . This was 
accomplished by assuming that the ratio of any given component weight to the 
total weight is independent of the probability of failure for small probabilities 
of failure. Normal distributions of load and strength were used, and the 
probability of failure was expressed as the inverse of the cumulative distribu- 
tion of the safety index. The mean safety factor was shown explicitly as a 
function of the probability of failure and the load and strength coefficients of 
variation. The weight minimization was accomplished using a Lagrange 
multiplier technique for the constrained minimization problem. A technical 
note by Ghista [35] also addressed the problem of weight minimization with 
a probability of failure constraint. The suggested trial-and-error technique 
for solution yielded satisfactory results for a two-member example problem . 

A survey paper by Coutinho [36] reviewed basic statistical and 
reliability concepts and discussed some government reliability specifications 
and their applicability. An interesting breakdown of types of failure and the 
responsibility for each was given: initial failures are usually traceable to 
manufacturing and quality control, wear-out failures to maintenance, and 
random failures to design. The philosophy and operational aspects of 
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reliability assurance engineering were discussed. Coutinho listed Hie four 
major causes of unreliability as: 

1. Lack of reliable methods for predicting operating environments. 

2. Unit-to-unit variations in resistance (within specification) . 

3. Design errors. 

4. Manufacturing errors . 

A qualitative comparison of the relative reliability of different types of aero- 
space systems was given. Airframes are credited with the highest reliability 
and electronics the poorest. However, it should be mentioned that alternate 
or redundant electronic systems can usually be provided at much less cost 
and weight increase than structural systems. 

Moon, Shinn, and Hyler [37] discussed the determination of design 
allowables for Military Handbook 5 [38] , the primary source of materials 
strength data in the aerospace industry. Statistical techniques for determining 
aHowable strengths on a probability basis, the use of specification values and 
typical values, the derivation of design allowables for a given property from 
closely related properties, and the determination of allowables at other than 
room temperature were discussed. 

A final report of the Task Committee on Factors of Safety, American 
Society of Civil Engineers, was written by Freudenthal, Garrelts, and 
Shinozuka [39] . This is an extremely useful reference which defined 
commonly used terms in reliability and gave concise derivations of 
important structural reliability relationships for numerous cases . As would 
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be expected for this type of report, much of the material had been developed 
and published earlier , but this publication brought the information together in 
an easy-to-use handbook style . The report will be frequently referenced in 
this research, especially where it concisely states some commonly accepted 
principle that has been gradually developed by a number of contributors . 

The task committee defined the safety factor as the ratio of resist- 
ance to load, and since resistance and load are random variables, the safety 
factor is also a random variable. The report showed how to treat multiple 
member structures under multiple load cycles. This was done for the case 
that resistance and load are independent of the number of load applications 
and for the case that one or both depends on the number of previous load 
applications . Consideration was given to loads applied at specified times 
(life is measured in number of load applications) and to loads governed by a 
Poisson law (life is measured in time) . Fatigue was treated by the residual 
strength concept, where resistance is a decreasing function with number of 
load applications . 

Evidently, the first attempt at recommending specific safety factors 
for aerospace structures that vary depending on the desired reliability and the 
nature of the design was made by Bouton, Trent, and Chenoweth [40] . These 
authors developed, based on statistical analyses, a matrix of safety factors to 
be used under various conditions. To select the appropriate safely factor, 
one of three overall reliability objectives is chosen: 0.99 for high-risk 
vehicles, 0.9999 for standard vehicles, and 0.999999 for low-risk vehicles. 
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Beyond this, the safety factor selected depends upon the expected strength 
scatter in the structure under consideration (four classes are listed) and 
whether the loads and strength are verified by test. The recommended safety 
factor ranges from 1.15 for a high-risk vehicle, with small scatter in strength 
and loads and strength verified by test, to 4.0 for all structures not verified 
by strength test and all structures with large strength scatter and no test 
verification of loads . The approach seems to be a very reasonable step beyond 
the usual practice of arbitrary selection of safety factors , and it is surprising 
that the approach or some variation thereof has not come into general use in 
the aerospace industry. Perhaps the reluctance to use the method stems from 
the a priori judgments which must be made: selection of a reliability goal and 
determination of strength variability. The present research contributes to a 
rational means of resolving this problem through the use of decision theory. 

Statistical analysis of fail-safe designs was considered by Shinozuka 
and Itagaki [4i] . It was shown in an example problem, which could ideal- 
istically represent a three-spar wing, that the probability of survival after 
failure of one member is undesirably low (in the range of 0.20 to 0.33) , even 
for a ductile material. The failure condition considered was yielding of the 
structure, and the authors indicated that different conclusions could be 
expected for a fatigue failure mode . 

An article by Turkstra [42] discussed the choice of design from a 
set of designs with equal functional value based on minimization of expected 
loss. The basic idea offered was that, within a reasonable approximation 
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under certain conditions , only bounds on reliability of the candidate designs are 
needed, and the design selected should be the one with minimum cost which 
has a reliability within a prescribed value; that is, all designs with reliability 
falling within the prescribed reliability are equally acceptable, regardless of 
the exact reliability. This can considerably simplify cost optimization calcula- 
tions . The costs considered were initial costs and the expected cost of failure . 
Initial cost was assumed to be a linear function of the mean safety factor. 
Turkstra's method would be very limited in aerospace applications, since the 
assumption of equal functional value for all structures would rarely apply. 

For example, the functional value of aerospace structures depends greatly 
on the weight of the structure, which is a function of the safety factor. Thus, 
designs with different safety factors have distinctly different functional values, 
because increased weight in the structure usually results in decreased payload 
weight. 

A paper by Moses and Kinser [ 43] gave computational methods for 
multiple member structures under multiple load conditions. The authors 
emphasized the bounds on reliability and the relationship of the bounds to the 
degree of dependence among the failure modes . Computations of the reliability 
were made, using the known dependence of failure modes, for comparison with 
the bounds when complete independence, then complete dependence, of the 
failure modes were assumed. It was concluded that the essential relationship 
which controls the dependence, assuming that loads on all members arise from 
a common source, is the load variability compared with the strength variability. 
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A small relative variability of load leads to statistical independence, and a 
large variability of load relative to strength variability leads to statistical 
dependence. 

It was clearly demonstrated in the paper that an assumption of 
independence of failure modes, when dependence actually exists, can cause a 
significant underprediction of reliability. However, the particular example 
problem chosen seems to amplify the effects of such an assumption because of 
the low reliabilities involved. For more typical, higher reliability, the 
difference in predictions using assumptions of dependence and independence 
would not differ so much. 

Weight optimization with a constraint on the probability of failure , 
which was examined by Hilton and Feigen [30] and Switzky [34] , was treated 
by Moses and Kinser [44] with dependence of failure modes considered. They 
showed that additional reduction in weight can be achieved if the assumption of 
the independence of failure modes is discarded in favor of a more exact 
treatment. 

A book by Pugsley [45] treated the subject of structural safety in 
an easy-to-read fashion. Several chapters dealt with elementary structural 
concepts and analysis, followed by a discussion of the variability in strengths 
and loads and the risk of failure. The safety rules (or design codes) used to 
obtain safe structures were then discussed. An interesting chapter on "Some 
Famous Accidents" illustrated some of the conditions which can result in 


unsafe structures. 
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An excellent treatise of the bounds on structural reliability was given 
by Cornell [46] . The bounds depend upon the degree of dependence among 
loads and among failure modes. Expressions for upper and lower bounds on 
reliability were first given for a fundamental problem with time-independent, 
equally distributed resistance subjected to a sequence of random loads. A 
generalization was then made to time -dependent loads, time-dependent 
resistance, and unequally distributed resistance. 

Blake [13] discussed the direct application of statistical decision 
theory to structural reliability problems . He emphasized the importance of 
the cost effectiveness of a design as opposed to the desirability of the same 
fixed safety factor or the same fixed value of reliability for every component 
in a structural design. Relationships were developed for sizing a structural 
design to obtain a reliability such that system effectiveness is maximized. If 
the loads on the system and the strength of the system are normally distributed, 
the reliability was shown to be related to the safety index, and the optimum 
safety index was tabulated against a measure of the change in system effective- 
ness with safety index. 

Blake continued his development by considering the possible loss of 
system effectiveness for nonoptimum safety index. Since exact knowledge of 
effectiveness, safety index, and reliability is not usually available, the 
approach adopted was to minimize the loss in effectiveness for nonoptimum 
choice of the safety index. This leads to a nonoptimum design size with a 
conservative bias. The foregoing preceded a discussion as to whether more 
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information, which would permit selection of a design size nearer the optimum, 
would be worth the cost of such information, and led to a realization that, in 
addition to the intrinsic random nature of design variables affecting reliability, 
there is also uncertainty associated with a lack of complete information. Both 
of these uncertainties should be considered in cost optimization . The author 
also pointed out that the Bayesian approach permits the incorporation of 
subjective judgments with objective data in reaching a design decision. 

Benjamin [47] described the advantages of probabilistic design as 
compared with deterministic procedures . The author envisioned deterministic 
approaches as lacking in informational content, modeling of reality, refinement 
of analysis and design, and decision-making. Illustrations showed that the 
designer is not usually fully aware of the true state of affairs when determ- 
inistic approaches are used. A simplified Bayesian-type decision tree was 
presented, illustrating the choice of an optimum building design for earthquake 
loading. 

Bouton and Trent [19] elaborated on the ideas initially set forth by 
Bouton, Trent, and Chenoweth [40]. They described in great detail how a 
variable safety factor requirement could be incorporated into the technical 
and contractual management of aerospace systems and made an extensive 
evaluation of previous structural criteria proposals to show that none of these 
could fulfill what they considered the essential requirements of structural 
criteria. Most of the other proposed criteria could not satisfy a requirement, 
considered essential by the authors, that a means of proof of compliance must 
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exist for the criteria. For example, if the criterion is that the structure must 
have a certain reliability, then proof of compliance is virtually impossible 
before the structure is placed in service . Thus , structural criteria which 
specify reliability would not be acceptable to the authors . 

A proposal for separating loads into "limit" and "omega" conditions was 
presented. The limit condition is a load at which the structure is expected to 
survive, and the omega condition is a load, possibly caused by malfunction of 
other systems , beyond which the structure is not expected to survive . 

The primary thrust of the work by Bouton and Trent was an advocation 
of changes in the present safety factor system for airframes. They showed 
how structural reliability fits into the total system approach, and emphasized 
the need for establishing exactly what is expected of the structural system and 
design and test procedures for obtaining and measuring compliance with what 
is expected. The system created by them utilizes deterministic safety factors 
for analysis and testing which have been established by probabilistic tech- 
niques . The approach retains the advantage of having designers and analysts 
working with a given safety factor but also has the advantage that the safety 
factor has been determined in a rational manner. The basic premise for 
setting the safety factor is a reliability goal, but the safety factor also depends 
upon the scatter in strength of like structures and upon the number of tests 
contemplated. 

There can be little doubt that such a comprehensive evaluation and 
thorough proposal was a result of much study and deliberation. It appears that 
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the proposed criteria would be workable aad would be a significant improvement 
over present practices . It does seem that the authors may have overlooked 
some plausible alternatives because of a preoccuptation with the legalistic 
aspects of the problem. For example, the proof of compliance previously 
mentioned and a requirement that blame for any failure must be traceable may 
be desirable goals but probably should not be permitted to dominate or mask 
other important objectives. 

Kececioglu and Haugen [li] summarized various definitions of safety 
factors , safety margins , and measures of reliability which have been used 
and illustrated the use of some of them. A curve showing reliability as a 
function of safety index for normal distribution of loads and strength was given. 
Disney, Lipson, and Sheth [8] published formulas for determination of the 
probability of failure for several commonly used distributions of loads and 
strength. 

Some simplifications to the Hilton- Feigen model for minimum weight 
[30] were made by Murthy and Subramanian [48] . Some approximations were 
introduced that resulted in a set of equations which, unlike the Hilton-Fiegen 
model, could be solved without iteration. Some results in an example problem 
using the approximate solution had a close correspondence to the exact 
solution . 

Shinozuka presented a model for weight-optimized design subject to a 
constraint on expected cost [49] . The expected cost consisted of the expected 
cost of failure in service and in proof testing. The proof test was considered 
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to truncate the strength distribution at the proof-test level, and the reliability 
in service was thus enhanced. The optimization was performed with respect 
to the proof-test load level; that is, a proof -test level which minimized expected 
cost or weight was the result of the analysis. The procedure was developed for 
both determinant and indeterminant structures . 

The use of statistical decision theory as a tool in design is discussed by 
Cornell [50] . The Bayesian method of incorporating all physical, parameter, 
and model uncertainties into a single probability law was emphasized, since 
such a law can be used directly in design decisions and reliability estimates. 

A qualitative description of the residual strength concept of fatigue was 
given by Bouton and Trent [51] , The basis of the concept is that fatigue 
failures are, in reality, ultimate strength failures of fatigue -damaged struc- 
tures. The analysis of such structures had previously been considered by 
Freudenthal, Garrelts, and Shinozuka [39] . The relationship of the concept 
to the amount and type of testing required was discussed. 

Shah [52] advocated a design code in which resistance and load are 
recognized as probabilistic quantities . Some of the fundamental aspects of 
reliability and statistics were reviewed. A factor to account for differences 
in laboratory and field strengths was considered. Sexsmith and Nelson [53] 
discussed the limitations in the application of probabilistic concepts to struc- 
tural design. Each limitation mentioned was accompanied by a discussion of 
how it might be overcome . Some of the limitations examined were problems 
in selecting a model, consideration of subjective information, use of 
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information in making a decision, and confidence limits on reliability. 

A generalization of the classical probability of failure concept as a 
structural criterion was proposed by Ang and Amin [54] . A concept of the 
"probability of unsafety" was introduced such that the event (R/S < v ) , v > 1 , 
constitutes a state of unsafety, where R is structural strength or resistance, 

S is the applied load, and v is a factor for uncertainty. For v = 1, the 
concept reduced to a conventional reliability analysis. It was proposed that 
the known probabilistic information be incorporated into R and S and that v 
account for any remaining dispersions or unknowns. The structural require- 
ment would then be expressed by the condition P [R/S < v) < a , where a is 
the allowable risk. It was further shown that a reasonable and conservative 
choice for a is pq where p is the probability of having a structure with 

resistance less than a characteristic value, R , and q is the probability of 

P 

occurrence of a load greater than a characteristic value, S . 

Q. 

The principal advantages of the approach are that it separates the 
uncertainty into subjective and objective parts and it makes the design much 
less sensitive to the assumed distributions of R and S if a is chosen as 
pq. The disadvantage of the approach seems to be that it involves several 
somewhat arbitrary choices (t>, p, and q) instead of one choice, for instance, 
a level of reliability. It also appears that Bayesian statistics may be a more 
consistent way to introduce subjective uncertainties than the proposed method. 

A structural design code was suggested by Cornell [15] in which the 
safety factor selected depends only upon the means and coefficients of variations 
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of resistance and load, but not upon their specific probability distributions. To 
apply the method, however, a value of the safety index j3 must be selected, 
evidently somewhat arbitrarily. The author suggested that /3 be specified in 
the code and that its value depend upon the consequences of failure. 

Yao and Yeh [55] concentrated upon developing a procedure for system- 
atically counting the failure paths in a redundant structure in the formulation of 
a reliability analysis. 

Thomas [17] summarized the test results for large structural assem- 
blies in the Saturn V launch vehicle system and gave a rationale for determ- 
ining safety factors for structures which would not be tested. The Saturn V 
test data confirmed the trend of the Jablecki data [ 20] in showing that struc- 
tural failures are to be expected frequently in static testing of large assem- 
blies. Such failures were seen as error disclosures by Bouton and Trent [19] 
and are usually attributed to analysis inaccuracies or errors . The Saturn V 
data showed a trend toward more accurate analysis as compared with the 
Jablecki data which were compiled from tests in the 1940's. 

An analysis of the Jablecki data was performed by Chenoweth [ 56] to 
determine the safety factor which would be required for untested structures . 
The analysis showed that large safety factors (in a range from 4 to 11) would 
be required to assure a reliability of 0. 9999 in sustaining limit load. Although 
the conclusions of the paper are generally acceptable, the definition of 
reliability as the probability of sustaining limit load is inadequate for quantita- 
tive decision methods . In a more refined analysis , the probabilistic aspects 
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of the loading should be considered , and reliability should be defined in terms 
of the probability of failure in service. This would undoubtedly result in lower 
required factors of safety than those shown in Chenoweth's paper, since limit 
load is usually considerably larger than the expected load. 

Stevenson and Moses [57] presented an analysis method for determining 
the probability of failure in structures for which the failure mechanism is 
expressed as a linear combination of several resistances and loads . The 
method was applied to the limit design of frames in which the resistances were 
the plastic hinge moment capability of joints and the loads were applied to 
various points of the frame. It was shown that variance in strength and load 
has a large effect on reliability, that the particular form of statistical distribu- 
tion assumed has a small effect for high failure probabilities and a large 
effect for low failure probabilities, and that the dependence between failure 
modes is not very significant if the dependence is weak. 

A paper by Shah and Tang [58] developed a procedure for determining 
load factors. One criterion used was cost, based on a simple model consisting 
of construction cost and expected cost of failure . A summary of the views of 
several European committees studying structural safety was given by Rowe 
[59] . The basic approach was deterministic, but the deterministic factor may 
be developed from several sources of uncertainty which could be represented 
probabilistically . 

Optimum design with respect to weight with a constraint on the prob- 
ability of failure was the subject of a paper by Moses and Stevenson [60] . The 
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application was to both elastic design and limit design of frame structures. 

The problem was similar to that addressed by Hilton and Feigen [30] , Switzky 
[34] , and Moses and Kinser [44] except that limit design failures were 
considered. 

Ghare [61] discussed the perogative of the designer in trading off the 
safety factor used in design with the quality factor associated with production 
to obtain a required reliability within prescribed resources. 

An ultimate strength analysis of more than 300 data points of different 
types of aircraft structures and components was presented in terms of test 
strength compared with analytical strength [62] by Freudenthal and Wang. 

A comparison with the Jablecki data [20] showed some improvement in 
analytical prediction. The data were used in two reliability analyses of air- 
craft by disregarding the fact, recognized as questionable by the authors, that 
strength deficiencies discovered in tests would be rectified. 

Blume [63] discussed the philosophy of public safety in civil structures 
and the consideration of economic and safety trade-offs . The paper was a 
discussion only, with no analysis given. In the same volume, Freudenthal [64] 
discussed similar questions and suggested a model for selecting reliability 
based on minimizing the total expected loss. The expression for loss accounted 
for initial costs (which may be a function of reliability) and expected cost of 
failure, the product of cost of failure and probability of failure. 

Carnahan published an investigation of the reliability growth in orbital 
launches from 1958 to 1968 [65] . Data in this article showed that the overall 
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reliability has grown from about 50 percent in 1958 to about 95 percent in 
1966-1968 and has leveled off at about 95 percent. The causes of failure were 
examined and found to be almost entirely hardware related , as opposed to 
personnel or procedural. Ninety percent of the failures were mechanical, 
and of these 48 percent were in nonmoving parts. The author defended 
component testing as the least expensive means of increasing launch reliability. 

An excellent review of statistical methods in fatigue was given by 
Wirsching and Yao [66] . Emphasis was on various ways of presenting fatigue 
data and the use of the Weibull distribution for representing fatigue life. An 
estimation of parameters for the two-parameter and the three-parameter 
distribution was discussed and illustrated. The graphical method, the method 
of moments, and the maximum likelihood method were presented. 

Ang [67] further developed the concept of unsafety introduced by Ang 
and Amin [ 54] . The concept is that separate devices are used to account for 
subjective and objective uncertainties. Subjective uncertainties are taken 
into account by the conventional technique of requiring that some characteristic 
value of resistance is equal to the product of a safety factor and a character- 
istic value of the applied load. Objective uncertainty is considered by 
requiring that the probability that the desired subjective safety factor exists 
be a predetermined value . This value is called the probability of unsafety . 

Ang recommended that a log-normal distribution always be used for the 
subjective safety factor, based on physical grounds. When this is done, the 
objective probability of unsafety becomes much less sensitive to the assumed 
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statistical distribution of resistance and load than would exist if all uncertainty 
is incorporated into the probability of unsafety. It should be noted that two 
separate deterministic selections must be made to apply the method: a safety 
factor and a desired probability of unsafety. 

An extension of the Shinozuka model [49] was presented by Heer and 
Yang [68] . The area of extension was in the application to designs susceptible 
to brittle fracture in which the growth of flaws due to cyclic and sustained 
loading was considered. The effect of the flaw growth is to lower the struc- 
tural resistance with use of the structure. In the optimization procedure, 
weight was optimized with a constraint on the total expected cost. The predic- 
tion of the reliability of structures subjected to stationary random excitations 
was considered by the same authors [69] . The degradation of resistance by 
the loading history was considered in the reliability prediction. The applica- 
tion of the random loading was to a single-degree-of -freedom system, along 
with other quite restrictive assumptions . 

In a philosophical paper [70] in 1971, Lind formalized the art of safety 
factor selection and showed that the rationale of several proposed design codes 
can be derived from various combinations of a small set of postulates . The 
postulates common to all of the proposed codes were first enumerated. For 
example, the consideration of strength as a random variable is one of these 
postulates. Next, the postulates peculiar to the individual code proposals 
were stated. For example, Cornell [15] postulated that the means and coef- 
ficients of variations of loads and resistances should be considered as a 
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sufficient statistical description. 

Hardrath [71] presented an excellent capsulation of the fundamentals 
of fatigue and fracture mechanics and included a bibliography of approximately 
200 sources. The Task Committee on Structural Safety of the ASCE Structural 
Division published a literature review of structural safety [72] which contains 
a useful bibliography of approximately 400 references . 

A paper by Tang and Yao [ 73] extended the Miner fatigue damage 
criterion such that the fatigue lives (in cycles) at each stress level are treated 
as random variables instead of constants. In this case, the cumulative damage 
itself then becomes a random variable . 

Campion, et al. [74] evaluated the criteria developed by Bouton and 
Trent [ 19] . The method was reviewed to determine the data required and the 
availability, the implications of such an approach in the structural design 
process, the methods by which the implementation could be achieved without 
discontinuity, and handbooks. A trial application of the procedure was made 
to the C-141 transport aircraft wing. The evaluators concluded that total 
application of the procedure is premature, essentially because of a lack of 
data for implementation. Additional trial applications to existing systems 
were recommended, along with efforts to collect and develop the required 
data. 

A development with an optimization objective closely paralleling that 
of the present research was presented by Mau and Sexsmith [ 14] . This was 
a problem of optimizing expected cost as an unconstrained minimization 
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problem,, The result was a Bayesian-type decision process, illustrated 
by the authors in a simple decision tree. The entire model was extremely 
simplified to minimize computations. For example, the initial cost of 
the structure was related only to the material costs, failuremodes were 
assumed independent, costs consisted only of initial costs plus the 
expected cost of failure, and load and resistance were assumed normally 
distributed. Permitting different types of testing in the design alternatives 
was not considered. 

Lind [ 75] proposed distribution functions for load and resistance 
composed of a normal central portion and an exponential tail portion 
for reliability calculations. Lind believed that the incorporation of new 
data with prior data by simply recalculating the required statistics was 
simpler than a Bayesian procedure for the proposed distributions. 

Several probabilistic models were reviewed by Heller [ 76] with 
respect to their representation of component life. The viewpoint was a 
comparison of the physical phenomena to be represented with the properties 
of the models (normal, log-normal, exponential, orWeibull). It was 
shown that the Weibull model provides a convenient representation of life- 
type phenomena. Graphical means of determining model parameters 
were discussed and illustrated with a fatigue example. This was done for 
both complete samples and for extreme observations. 

A review of statistical methods applicable to structural reliability was 



46 


given by Lemon [77] . The concepts of conceptual models, distributions, and 
parameters were reviewed, including the basic terminology used to describe 
distributions. A very readable explanation of order statistics was given. 

Point and interval estimation of parameters was explained and "within" and 
"between" batch variability was discussed. Chi-square and Kolmogorov- 
Smirnov goodness-of-fit tests were explained. A fairly thorough treatment of 
the Weibull distribution was presented, including illustration of the effects of 
parameters, parameter estimation, distribution of certain functions of the 
parameters, and confidence bounds on the parameters. 

Forney [78] discussed the recent improvements in reliability methods 
for computing fatigu. • <es of aircraft structures, particularly the development 
of models for estimating the expected time to the first failures in a fleet. A 
multiphase program of the Air Force Materials Laboratory for reducing 
structural reliability analysis methods to practice was described. One phase 
of the program was concerned with cost and weight trade-offs as affected by 
reliability; this is closely related to the present research. 

Some of the problem areas in structural reliability computation and 
communication were pointed out by Bouton [79] . Among these are the effect 
of analytical errors and the problem of giving a precise definition to reliability. 
For example, the importance of defining whether the reliability pertains to the 
entire fleet or to a single aircraft was pointed out, as well as the need for 
carefully defining what constitutes a failure. 

Buntin [80] discussed a proof -test program currently in use on the 
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F-lil aircraft. The main purpose of the proof -test program is to detect flaws 
in high-strength steel parts in the aircraft which could cause failure during 
service. The program was instituted because an early flight failure was 
attributed to a flaw in a wing-pivot fitting. Basic fracture mechanics and 
proof test concepts were described, including a method of allowing for a yield 
zone at the crack tip . A flow diagram for calculating the probability of 
surviving a given number of flight hours after proof test was shown, but 
analytical details were not given. From a total of 325 operational aircraft 
which were proof tested, two failures occurred during testing, neither related 
to flaws . This demonstrated the ability of proof testing to detect anomalies 
other than flaws. 

A discussion of the latest developments in the U.S. Air Force structural 
integrity program was presented by Haviland and Tiffany [81] . The discussion 
revealed a trend toward more attention to fatigue and fracture toughness 
problems, a result of encountering such problems on the F-ili and C-5A 
airplanes. Rosenfield [18] discussed the static test philosophy of the U.S. 

Navy on major aircraft structural assemblies. A review of [16] , [17] , [18] , 

[ 19] , [ 20] , [ 62] , and [ 81 ] reveals a marked similarity in static structural 
test methods used by the Air Force, Navy, and the National Aeronautics and 
Space Administration. 

There can be little doubt that some important contributions in the field 
of structural reliability have not been included in this literature review. How- 
ever, it is hoped that the review does include a sufficient number and variety 
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of contributions to provide the reader a beginning point in the pursuit of some 
particular aspect of this many-faceted and interesting field of research. 
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CHAPTER HI 

STATEMENT OF THE PROBLEM, THE SETTING, AND THE 
METHOD OF SOLUTION 

3. 1 State ment of the Problem 

In this section a concise statement of the research problem, a discussion 
of the related topics to be considered, the problem setting, and an overview of 
the method of solution will be outlined. 

3. 1. 1 Concise Statement o f the Research Problem 

The need for structural testing of aerospace structural systems has been 
shown separately by Freudenthal and Wang [ 62] , Jablecki [ 20] , and Thomas [ 17] . 
Their results show that one- third to two- thirds of the tested structures fail at a 
load lower than that predicted by the analysts. The terms "analyst's predicted 
failure load" or "design ultimate load" have been used to designate the actual load 
predicted by the analysts at which failure is predicted to take place. No safety fac- 
tors are included in this load. Aerospace structural testing is expensive, and the 
sample sizes are usually small. In addition to the influence of structural testing 
on the cost of the structural system, a prescribed safety measure also influences 
the cost through its effect on reliability and performance. Safety measure has 
been used as a general term meaning the safety factor, reliability measure, 
safety index, or other variable used to control the strength of the design. 

The research program discussed in this dissertation is to develop a 
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methodology for selecting a suitable test option and an appropriate safety 
measure based on optimized expected cost 0 In the course of the development 
two additional problems have been considered, the solutions to which were 
required to provide information needed as input to the cost optimization model. 

1. In preliminary design and in making design decisions on the test 

options and safety measures based on optimized expected cost, it is necessary 

to estimate the probabilistic strength or failure distribution before testing has 

> 

actually been carried out and the observed data become available. In this 
dissertation a methodology will be developed to systematically obtain the 
subjective expert opinion by using mail questionnaires and to use the answers 
to these questionnaires to represent the probabilistic strength distribution 
analytically. These investigations and developments are discussed in 
Chapter V. 

2 0 In developing the methodology to select the test option and safety 
measure, it is necessary to update the probabilistic strength distributions as 
new data become available in the form of test data or flight experience. 
Furthermore, any procedure for updating should be adapted to the structural 
testing procedure used in the aerospace industry, which will be discussed in 
Chapter IV. This has been accomplished using Bayesian techniques and is 
discussed in Chapter VI. 

3.1.2 Related Topics 

Several individual, closely related topics must be investigated and 
placed in a proper relationship to each other in the research program. Each 


51 


topic is underlined in the following text. 

The first topic to be discussed is f Structural testing . " The topic can 
perhaps best be introduced by examining an almost universally used structural 
test procedure which may be regarded as a "standard* 1 procedure. An examina- 
tion of Thomas [ 17] , Rosenfeld [ 18] , and Bonton and Trent [ 19] shows that 
such a procedure is used by the United States Air Force, the Navy, and the 
National Aeronautics and Space Administration in testing airframes. This 
standard procedure consists of testing one full-scale specimen of each of the 
major structural assemblies which compose an airframe. The testing is 
accomplished by applying static loads to the assembly with hydraulic cylinders, 
weights, airbags, etc. Ideally, the test article is constructed from the same 
design drawings as the flight articles. Often, th've are compromises in this 
respect. If a failure occurs at less than the predicted failure load, a design 
change is made, and a retest is accomplished. This procedure is iterated 
until one design "passes" the test, and the successful design is then used in 
production airframes. To permit a lucid description, the above procedure has 
been highly idealized. 

In some aerospace programs, records have been kept which give some 
insight into the levels at which failure can be expected in such testing. 
Freudenthal and Wang [ 62] , Jablecki [ 20 1 , and Thomas [ 17 ] present such 
records. The failure levels in certain groups of structures are illustrated by 
the cumulative distribution functions (CDF's) plotted in Figure 1. The CDF T s 
for the recent aircraft data and the aircraft data from the 1940's are incomplete 
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Figure 1. Failure Data for Structural Assemblies, 
because the data were preserved only for assemblies which failed at less than 
100 percent of design load. 

Although the difference between the 1940 data and the more recent 
results indicates a significant improvement in analytical accuracy, the role of 
the standard static test as an error discloser is still very evident. It is 
important to realize that the distributions in Figure 1 do not represent the final 
product, since the standard procedure requires a design change and a retest of 
any structure failing to achieve design ultimate load. Although some uses have 
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been made of test and flight data, no procedure has been developed in the 
aerospace industry to analytically update the strength distribution after redesign, 
retest, and flight experience. Bayesian techniques will be used to develop such 
a distribution in the present researcho 

The standard test procedure has been effective in producing acceptably 
reliable structural systems. However, as pointed out in Chapter I, there is no 
evidence that it is the most cost-effective procedure for every system, 
especially if the prospect of varying the design safety measure is admitted. 
Alternatives to the standard procedure will be introduced and discussed in 
Chapter IV. 

To use statistical decision theory in selecting a particular test option 
from various available test options, it is necessary to know the probabilistic 
representation of the structural str ength distribution for each proposed test 
option. For example, one of the CDF T s in Figure 1 could be taken to represent 
the strengths before any redesigns are applied to the understrength assemblies. 
Beyond this simplest case, no observed data have been located to calculate 
strength distributions for other test options. However, Ba yesian procedures 
[ 2] , for example, permit the use of any available information — observed or 
subjective — in obtaining strength distributions or in other elements of the 
decision process. 

Furthermore, even for test procedures where no observed data have been 
accumulated, the subjective belief of the decision-maker can be used to establish 
a distribution for the purpose of making a decision. Collective expert opinion 
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has been used to establish probability data for oil spills [ 82] , by Nair, Shah, 
Smith, and Shah. A similar technique will be developed in the present research 
program on structural reliability. The accuracy of such a procedure will be 
established by direct comparision of some subjective distributions obtained 
from expert opinions with the available observed data, such as shown in 
Figure 1. 

Once particular distributions of strength have been established for the 
various test options, a second design variable under the control of the designer 
can be exercised. This is the design safety measure as discussed in Chapter I. 
The safety measure commonly used in aerospace structures is the safety factor, 
which establishes some characteristic value of the structural strength or 
resistance relative to a characteristic value of the load. The design safety 
measure to be exploited in the present research is the safety index, since it 
permits the designer a greater flexibility by allowing him to control variability 
as well as a characteristic value. 

The safety index has been shown to provide computational convenience 
if both load and resistance are normally distributed. For example, see 
Kececioglu and Haugen [ 11] or Mau and Sexsmith [ 14] . Cornell [ 15] proposed 
the use of the safety index in a design code and pointed out that it can be used 
as a safety measure when only the means and variances of load and resistance 
are known, and no other information is available about the actual distributions. 
The role of the safety measure in controlling the resistance is illustrated in 
Figure 2. For simplicity, the safety measure used for illustration in this 
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Figure 2. Effect of Safety Factor. 
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figure is the mean safety factor, v . 

In Figure 2, the load distribution is assumed to be known, and the figure 
is assumed to be drawn for a particular test procedure, which determines the 
shape of R. The shape is the same for R 1 and R 2 . The designer can thus con- 

o o 

trol the strength of his design by selecting a design mean safety factor, ^ or 
(or any other value) . A similar argument holds for any other design safety 
measure. 

The role of the test procedure and the design safety measure in con- 
trolling the design strength has been discussed. The designer is confronted 
with the decisions of what test procedure and what value of the design safety 
measure to use for his design. Since the load and strength are not deterministic 
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values but are represented by probability distributions, this is a decision in the 
face of uncertainty. Provided that the designer can quantify in a prescribed 
m ann er his preferences among the possible outcomes that will result from each 
of his alternative decisions and an assessment of the probability of each 
possible outcome, statistical dec ision theory provides a formal framework for 
making such a decision. 

In this particular application, the preference for outcomes will be 
expressed in terms of the cost of each outcome. The cost model is expected 
to include all of the significant costs relevant to the decision. These include 
development costs, maintenance costs, cost of failure, and cost of loss in 
performance, each of which may be further subdivided. 

3.2 The Problem Setting 

It is important to delineate the setting in which the decisions of what 
type of testing to do and what safety measure to use are most conveniently made. 
Of course, such decisions could be made at almost any time during the design 
process. However, the decision process developed in this research would 
appear to be more appropriately applied during one particular phase of the 
typical design cycle. 

To apply the decision methodology developed here, certain information 
peculiar to the particular structural system in question must be available. 

This includes such information as the change in weight as a function of the 
design safety measure, the economic value of changes in the structural system 
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weight, and the anticipated cost of various methods of testing. It seems evident 
that a preliminary design must be available to develop this type of information. 
Of course, it might be possible to extend the present method to use probabilistic 
estimates of this information before design has begun. 

On the other hand, if a detailed design has alreacfy been developed, 
fabrication drawings have been released, and test hardware and facilities com- 
mitted, a decision to change the design safety measure or the method of testing 
would be costly. 

From the preceding discussion, it can be inferred that the appropriate 
time for applying the decision methodology to select a test program and a design 
safety measure is after preliminary design is completed but before detailed 
design begins. For example, the methodology is not intended to provide a means 
of selecting between a skin- stringer design and a honeycomb sandwich design, 
for, say, an interstage structure. However, given that the design is skin- 
stringer, the methodology provides a means of selecting a safety measure which 
will, in turn, determine the required skin thickness and stringer cross sectional 
properties. Likewise, the methodology would dictate face sheet thickness and 
core properties, given a honeycomb sandwich design. This is not to say that 
the method would not be useful in selecting between these two design concepts. 
However, to influence the selection, the method must be applied to each design 
separately and the final results compared. 

Equally as important as the time phasing is an appreciation of the level 
of assembly to which the methodology applies. The method could be adapted to 
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any level of assembly, provided that data are available to determine statistical 
strength distributions for the particular level under consideration. However, 
for several reasons the present research is directed toward large structural 
assemblies such as complete wings, thrust structures, propellant tanks, or 
interstages. First, the available data for developing statistical strength dis- 
tributions are applicable to this level of assembly. Second, structural tests 
are usually conducted on these large assemblies. Next, it would be very 
inconvenient for the designer to attempt to apply different safety measures to 
the various subassemblies within the large assembly. 

The method is expected to be most applicable to structures under over- 
all compressive and bending loads. Again, the data from which the strength 
distributions are developed are for these types of structures. However, the 
compressive or bending loads in the test sample were often applied in a 
complex manner such as concentrated engine thrust applied to a large longeron 
which, in turn, shears the load into the fuselage structure. Thus, the results 
are expected to be valid for such structures. Extension to other types of 
structures would involve only a development of strength distributions for the 
structure of interest. 

3.3 Method of Solution 

In the first section of this chapter on the statement of the problem, some 
preview information on the method of solution was discussed in describing the 
problem and its ramifications. In this section, the method of solution is to be 
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made more specific. Although it is intended to give a complete outline of the 
proposed solution, extended discussions will be deferred to later chapters, 
where various subjects are developed in detail. It is intended to provide in this 
section a general outline of how the developments in Chapters IV through VI will 
be used in Chapter VII. 

An action or decision space is created. This consists of a discrete 
portion (the selection of one test procedure from several discrete possibilities) 
and a continuous portion (the selection of a design safety index from a continuous 
spectrum) . A complete action must consist of a selection of both a test proce- 
dure and a safety index. Selection of the test option determines the shape of the 
probabilistic strength distribution relative to the analysts 1 predicted failure load. 
This strength distribution is considered to be a part of the state of nature . 
Selection of the safety index determines the location of the strength distribution 
relative to the probabilistic distribution of the applied load, also considered to 
be a part of the state of nature. Every combination of course of action and state 
of nature results in a known value to the decision-maker. In particular, the 
negative of value in this problem is the cost associated with each combination of 
action and state of nature. The cost may include the development cost, cost of 
manufacturing, maintenance cost, cost of failure in operation and testing, and 
cost of loss in performance. 

The expected cost for each course of action is obtained from the definition 
of expectation. The action is selected (i.e. , the decision is made to use the 
test procedure and safety index) which results in the minimum expected cost. 
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The formulation just described is illustrated graphically by the decision 

tree in Figure 3. The fan-shaped displays for /3 , R. , and S indicate that these 

are continuous variables. No formal treatment of decision analysis or decision 

trees is given here. Raiffa [ 83] gave a very readable introduction to the 

subject. Pratt, Raiffa, and Schlaif er [ 2 1] gave a virtually self-contained 

development, and Benjamin and Cornell [ 2] gave a development oriented to 

engineering decisions. Savage [ 84] presented an exposition on the relationship 

of the Bayesian approach to other schools of thought in probability and statistics. 

Tribus [ 1] related decision analysis to a broader spectrum of ideas. After the 

problem has been cast in the form of a decision tree, the decision process will 

be based on the procedures presented by Pratt, Raiffa, and Schlaifer [ 21] . To 

analyze the decision tree, the expected cost for each test option, E[ U//3, T.] , is 

determined. This expected cost includes the direct cost . The direct cost 

i 

is that portion of the cost not affected by the state of nature. Figure 4 shows 
graphically how the minimum cost test procedure and corresponding safety 
index are selected. The optimum decision for the case illustrated in the figure 
is to select test option T 0 and the corresponding safety index, /3 0 . 

The decision problem has been placed in the context of statistical 
decision theory to take advantage of the formal developments in this field, 
which establish the conceptual and mathematical rigor of the procedure used 
to optimize expected cost. Chapter VII will be devoted to a more complete 
development of the decision model. 
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Figure 3. Decision Tree for an Assembly. 



Figure 4. Optimum Decision, 
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CHAPTER IV 

TEST OPTIONS, STRENGTH DISTRIBUTIONS, AND SAFETY MEASURES 

Statistical decision theory provides the basis for the research problem. 
However, it is instructive to discuss the problem in some of the terminology of 
optimal structural design to clarify the role of some of the variables involved. 
An introduction to this terminology has been presented in a review article by 
Sheu and Prager [ 85] . 

Geometric design constraints restrict the choices of structural type and 
shape open to the designer. In this dissertation, all overall structural dimen- 
sions, structural member arrangements, and the type of construction are con- 
sidered fixed. The only choices open to the designer are local dimensions such 
as thicknesses and cross-sectional areas. 

Behavioral design constraints set bounds on quantities that characterize 
the behavior of the structure under conditions of service. In the present 
research, the assumed behavioral constraint is that the structure shall not 
exhibit any behavior which indicates an inability to sustain the applied loads. 

The design objective for the structures considered here is the minimiza- 
tion of the total expected cost of the structure, including the probabilistic as 
well as the deterministic costs. It will be assumed that the test options and the 
design safety measures are the two design variables that can be used by the 
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designer to control the strength of a structural assembly. The test option can 
be used to control the strength by disclosing rectifiable design errors or by 
eliminating random understrength designs. The test option can also be used to 
eliminate some uncertainties regarding the engineer's knowledge of the design 
strength, thereby improving the accuracy in estimating the design performance. 
The safety measure can be used as a design variable to control the design 
strength by establishing a characteristic design strength relative to a charac- 
teristic load, or more generally, by controlling both a characteristic value and 
the variance of strength. 


4. 1 Test Options 

The concept of a test option is introduced in this section to explain a pro- 
cedure by which the method of testing can be used as a design variable. Unlike 
the classical experiment of statistical decision theory, the test option includes 
a predetermined (deterministic) response by the designer to each possible test 
outcome. The testing and predetermined actions by the designer together are 
used to control the state of nature. The classical experiment in statistical 
decision processes is used to observe the state of nature. From a probability 
standpoint, a predetermined action means that for each possible outcome of the 
test, one particular subsequent course of action will be taken with probability 1, 
and there is zero probability that any other course of action will be followed. 

The standard test procedure discussed in Chapter I provides a ready example. 


For the outcome that the structural assembly fails to pass the test, the 
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predetermined action is to redesign and retest. For the outcome that the 
assembly passes the test, the predetermined action is to make no design change 
and to discontinue testing, even if the test reveals an overdesign. 

Four test options are included in this research. An unlimited number of 
test options could conceivably exist, and each could be treated in a manner 
similar to that presented here. It would be possible to create new test options 
by various combinations of the test options considered here. A description of 
each of the four test options is given as follows . 

4. 1. 1 No- Test Option, T n 

Under the No-Test Option procedure no structural testing is done. Analyt- 
ical predictions alone are used to establish the design and predict the strength. 
This is much like what is done on most civil engineering structures where 
structural testing is not accomplished on each individual design. It would be 
inprudent, of course, to use this option if some radically new design concept is 
to be used. 

4. 1. 2 Standard Test Option, Tj 

The Standard Test Option procedure has been introduced in Chapters I 
and III. This is the normal procedure used in the aerospace industry to qualify 
the airframe for flight use. It consists of testing one each of the large assem- 
blies such as a complete wing, a fuel tank, or an interstage structure which 
make up the airframe. More than one assembly may be tested in a single test 
setup. It is not unusual to test a complete airframe. A design change is 
required to be made on any structure failing to sustain design ultimate load. 
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Failure does not necessarily mean collapse or breakup; it could mean that some 
measured parameter such as displacement or strain falls outside a prescribed 
range. Testing and redesign are to be iterated until a design passes the test. 
Testing is to be done on assemblies built to the same specifications as the flight 
articles. 

4.1.3 Proof Test Option, T 9 

In the Proof Test Option procedure, every production flight article is 
pretested in the laboratory to some prescribed load level less than design 
ultimate load. Articles which fail to pass the proof test are discarded from the 
population or repaired and retested until they pass the proof test. This effec- 
tively prohibits the use of random understrength structures as flight articles and 
establishes a lower bound for the strength of those structures that are used. It 
is possible that proof testing could alter or damage the structure in a way that 
would invalidate its original characteristics. Before the proof test option is used, 
sufficient studies must be made to assure that the proof test will not be damaging 
to the structure. The proof- test procedure has been used extensively for 
pressure vessels, including the large propellant tanks of launch vehicles. Little 
use has been made of it for other types of structures and loadings. In the 
present research, test option T 2 includes the use of proof testing for all types 
of structures and loadings. For example, bending of wings and combined 
compression and bending of fuselage structures are considered appropriate for 


proof testing. 
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4.1.4 Model Test Optio n, T 3 

The Model Test Option procedure is to perform all testing on either scale 
models of the actual structure or subassemblies (components) instead of on 
complete assemblies. Such a procedure would not require large, complex test 
facilities. The evaluation approach would be an iteration of design, analysis, 
and testing until the analysis and test results agree. The same design would 
then be used for the flight hardware, and the analysis procedure which agreed 
with the model test results would be used to analyze the flight design. 

To accomplish the above procedure, it would be necessary to identify 
and numerically define the requirements of the flight article and to measure 
certain parameters identified with these requirements in the model testing. An 
analytical prediction of the same parameters must be made on both the test and 
flight articles , and the analytical predictions must agree with each other and 
with the test results before the flight article design is placed in service. This 
is the method by which model test results are projected to full-scale design. 

It would be desirable that the descriptions of test options be completely 
free of any ambiguity. However, the testing of complex aerospace hardware 
contains so many compromises that it is doubtful if this could ever be achieved. 
Hopefully, the preceding descriptions are specific enough to permit mutually 
exclusive classifications of the available test options within reasonable 
tolerances. It is not the objective to define a test option so rigorously that it 
would be difficult to plan a program which falls within a given test option. 
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4. 2 Strength Distributions 
4. 2. 1 Qualita tive Comparison 

The test options described above are deterministic in nature in that an 
a priori disposition of every test outcome has been established. Because of 
this, it is reasonable to postulate that a probabilistic strength distribution exists 
for the population of structural assemblies developed by each test option. Each 
of these distributions can be referenced to the strength value predicted by the 
analyst. This value is the 100-percent value shown in Figure 5, where a 
qualitative comparison of the strength distributions that might result from the 
various test options is shown. 

The general shape of the No- Test Option probability density function 
(PDF) is inferred from the Saturn Booster Data [ 17] for which the CDF is 
shown in Figure 1 of Chapter III. Note that other available data in Figure 1 
tend to confirm the general shape of the left side of Figure 5(a) . For the 
standard test option, all test articles which fail to sustain 100-percent load are 
redesigned and retested. However, this does not completely assure that all 
flight articles have strengths greater than 100 percent, since there would be 
some scatter among nominally identical structures. A distribution of the 
general shape of Figure 5(b) results for this test option. In Figure 5(c), r 0 
is the proof test level. Thus, any structures from the original population shown 
in Figure 5(a) with strengths less than r 0 are discarded from the population. 
This would result in a distribution similar to that shown in Figure 5(c). A 
model test program would eliminate some of the unknowns causing the scatter 
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part of specific system developments rather than as scientific research. In 
development programs the need for recording and compiling data in the form 
required to determine PDF's has generally not been recognized. 

Four sources of data on large structural assemblies have been located, 
but for various reasons only one, the Saturn V Booster data [ 17] , appears 
usable at this time. The Jablecki data [ 20] represents the state-of-the-art in 
the 1940's and is useful for showing the historical trend of analysis improvement. 
However, data are given only for assemblies which failed at less than limit load 
so that a complete PDF cannot be determined. Freudenthal and Wang's data on 
recent aircraft [ 62] also give the results on large assemblies, but only for 
premature failures. In addition, some panel, beam, and frame data (structures 
which should not really be described as large structural assemblies) are 
included. Martin and Bouton [ 86] presented the so-called Lustig data repre- 
senting aircraft from 1950 to 1970. Again, only premature failures were listed, 
and in this case not even the total number of tests is known. This makes it 
impossible to construct even a portion of the CDF, as was done for the other 
data in Figure 1, Chapter HI. 

The two following sections in this chapter will be devoted to determining 
strength distributions that can be realized by test options T 0 and T 2 , using 
reasonably well-established statistical analysis methods. Strength distributions 
that can be realized by test options T t and T 3 require special treatment and will 
be the subject of Chapters V and VI. 
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4. 2. 2 Strength Distributio n for No-Test Option, T 0 

4. 2. 2. 1 Saturn V Test Data . The test data of Thomas [ 17] are directly 
applicable to the No-Test Option, since these data represent a sample of 
structures before any redesign or retesting was accomplished. As such, the 
data can be interpreted as a sample from the population of structures which has 
not been previously tested. Table 1 is a listing of the failure loads for Saturn V 
structural assemblies as a percentage of the design ultimate load, assumed to be 
the analyst's predicted failure load. Thus, each data point is the strength or 
resistance, r. , of the particular structure tested. 

The data represent all of the major structural qualification tests on the 
Saturn V launch vehicle, including several assemblies from each of the three 
stages, interstages, and the instrument unit. In some cases, where more than 
one load condition was applied to a structure and the load conditions were 
distinctly different from each other, more than one data point was taken on a 
single structure. Note that there are a number of censored data points (tests 
which were terminated before failure occurred) in the sample. Tests were 
terminated for various reasons such as economy of testing or a desire to save 
the assembly for some other use. 

It would be impossible to give a general physical description of the 
structure or a general description of the types of loading that would characterize 
the sample of Saturn V structures. Construction ranged from riveted skin- 
stringer-frame design to honeycomb sandwich. Loading was usually 
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Table 1. Saturn V Test Data 


Structure 

Failure 

Structure 

Failure 

Number 

Load, r. 

Number 

Load, r. 

( Order 
Number) 

1 

(Percentage 
of Design 

(Order 

Number) 

l 

( Percentage 
of Design 


Ultimate Load) 


Ultimate Load) 

1 

71.5 

26 

99.3 

2 

77.2 

27 

100.0 

3 

80.0 

28 

100.0 

4 

82.2 

29 

100. 0+* 

5 

83.7 

30 

100. 0+* 

6 

85.7 

31 

100. 0+* 

7 

87.2 

32 

100. 0+* 

8 

87. 2 - 

33 

100. 0+* 

9 

89. 3 

34 

100. 0+* 

10 

89.3 

35 

100. 0+* 

11 

89.3+* 

36 

100. 7+* 

12 

90.8 

37 

100.7 

13 

91.5 

38 

101.3 

14 

92. 2+* 

39 

103. 6+* 

15 

93.0 

40 

107.2 

16 

93. 0+* 

41 

107.2 

17 

93. 0+* 

42 

110.8 

18 

93. 0+* 

43 

112. 1+* 

19 

93. 0+* 

44 

113.0 

20 

93. 0+* 

45 

115. 0+* 

21 

93. 0+* 

46 

115.7 

22 

93. 0+* 

47 

118.0 

23 

93. 0+* 

48 

125.0 

24 

93. 0+* 

49 

131.3 

25 

94.3 

50 

151.3 


*Censored sample 
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compressive or bending, but loads were often concentrated loads applied to 
large longerons or to beam or truss structures attached to the fuselage shell. 

It is important to note that throughout this research all large structural 
assem! 'm? are assumed to belong to a single population for purposes of 
statistical analysis. This is done irrespective of the mode of failure or the type 
of structure. Freudenthal and Wang [ 62] made an identical assumption, justified 
by the following statement: 

This assumption is unavoidable because replications of ui f imate load tests 
of large structures and structural parts are and will always be severely 
limited by technical and economic considerations. Without it, reliability 
analysis of aircraft structures becomes obviously impossible since the 
individual small samples are useless for this purpose. 

4. 2. 2. 2 Computer Program for Tw o- Parameter Weibull Distribution. A 
computer program developed by Hanagud [ 87] for estimating parameters of the 
two-parameter Weibull distribution for complete and censored samples was 
available at the Georgia Institute of Technology, School of Aerospace Engineer- 
ing. The computer program is based on the maximum likelihood method for 
estimating parameters as presented by Cohen [ 88] . The cumulative distribution 
function of the Weibull distribution is given by 



and the probability density function is 



73 



where R is the random variable, v is the scale parameter, and k is the 
shape parameter. The method of maximum likelihood is based on determination 
of the values of parameters k and v which maximize the joint probability of 
observing all of the data points in a particular random sample. For the present 
problem, this means that the method of Cohen can be used to determine values 
of k and v that maximize the likelihood of the joint occurrence of the data 
points in Table 1, including censored values. 

More specifically, the maximum likelihood estimator of the vector of 
parameters [ k, v] is the value of [ k, v] which causes the likelihood function to 
be a maximum* The likelihood function is proportional to the joint probability 
distribution of the random sample, assuming independent observations. Assume 
that (R , R 2 • • • R £ ) are observed failure loads and that (R^ +1> R^ +2 ••• R n ) 
are observations at which no failure occurred (censored values) . The joint 
probability of (R , R 2 . . . R^) for known [k,v] ip 


f Rl ,R 2 ... R, (r l’ V" r i lk * v > - 


fj, (rjlkjv) f R (r 2 lk,v) ... Ig (r^lk.v) = JJ ^ (rjk.v) 


( 4 . 3 ) 
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Similarly, the joint probability of the observed censored values is 


p ‘ ri W 


w 


P[R > 
n 


r ] 
n 


n 

= IT tl-F (r|k,v)] 

i=i +1 i 


(4.4) 


Regarding equations (4.3) and (4.4) as functions of unknown parameters 
[ k, v] , the likelihood function L gives the relative likelihood of observing-the 
sample (R^... R^, R^ +1 ».. R^) as a function of [ k, vj . 


L(k,v|R 1 = Tl 


R„ = r. 


R i+1 > 


'i+1* 


i 


n 



R > 
n 


r ) 
n' 


Explicitly, 



(4.5) 


(4.6) 


Since there is a monotonic, one-to-one relationship between the likelihood 

A A 

function and its logarithm, they have a maximum at the same values [ k, v] . 
Thus, 


in L 



(4.7) 
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Maximizing in L, the following equations are obtained for k and v: 



(4.8) 


(4.9) 


These equations can be simplified by eliminating v and obtaining an equation 
for k to be solved by Newton's iteration technique. 



(4.10) 


The value, k, satisfying equation (4. 10) is the maximum likelihood estimator 
for k and can be substituted into equation (4.9) to solve for the maximum 

A 

likelihood estimator v . A computer program for obtaining these estimators 
is given by Hanagud [ 87] . 

When the method was applied to the data in Table 1, maximum likelihood 

A A 

estimators of the parameters were determined as k = 6.43 and v = 115. 5. A 
plot of the probability density function f (r) that can be realized with test 
option T 0 is given in Figure 6. A Chi-square goodness-of-fit test, in which 



60 80 100 120 140 160 

R, STRENGTH - PERCENT OF ANALYST’S PREDICTION 

Figure 6. Strength Distribution for No-Test Option, 
only the uncensored data points could be used, showed that the model could be 
accepted at the 11-percent significance level. Six intervals of equal probability 
were used in the test. A computer program from Hanagud [ 87] was used for 
the Chi-square test. 

4.2.3 Strength Distribution for Proof- Test Option, 

A very common method of assuring the reliability of pressure vessels 
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and tanks in both the aerospace and civil engineering fields is the proof testo 
In this method of testing, before each production pressure vessel or tank is 
placed in service, it is pressure tested in the laboratory to a pressure greater 
than that expected to be encountered in service. The technique has seldom been 
used for structures other than containers, but there are notable exceptions. 

Buntin [ 80] described a proof-test program for the F-lll aircraft. The main 
purpose of the program was to detect flaws or crack-like defects in certain 
steel parts in the aircraft, which could cause failure in service. Although no 
such flaws were detected in proof testing of 325 operational aircraft, two pre- 
mature failures due to other causes did occur o This indicates the ability of the 
proof test to detect and eliminate defective structures of all types from the 
operational population of structures. 

An idealized representation of the effect of proof testing on the strength 
distribution is a straightforward application of truncated distributions as dis- 
cussed by Benjamin and Cornell [ 2] . If equation (4.2) is the strength distribution 
of the population of structures that have not been tested, then the distribution 
for proof-tested structures is assumed to be 


f R (r) =0 , r < r Q 


( 4 . 11 ) 


f R (r > 


1 - F 


ft 


< r o> 




k-1 




9 


where F R (r^) is the cumulative distribution of equation (4.1) evaluated at 
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ii i 
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the proof-test level r Q . The resulting distribution was illustrated qualitatively 
in Figure 5(c) « The distribution is plotted for 60-percent and 80-percent 
proof test levels in Figure 7» 



Figure 7. Strength Distributions for Proof- Test Options. 

4.3 Safety Measures 

Safety measures were defined and discussed in Chapter I. The effect of 
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the mean safety factor in controlling resistance relative to load was illustrated 
in Chapter HI. In this section attention will be focused on the relationship 
between the safety index and safety factor, and a particular safety factor will be 
carefully defined. 

In equation (l. 5) a characteristic safety factor was defined as 


«> . 


R - p<r R 
S + q<r s 


(4.12) 


In equation (1. 10) , the safety index was expressed as 


f> = - = — (4.13) 

Suppose that S , <r , and cr Q are known quantities, and a design safety index 

it b 

A 

P has been prescribed. Then the mean resistance required in the design can be 
established from equation (4. 13) as 

ft = p + cr 2 ' + S (4.14) 

±V O 

A 

If it is now desired to determine the design safety factor v consistent with the 

A 

prescribed 0 , equation (4 0 14) can be substituted into equation (4. 12) to give 


A 

V 


4^- 


R 


+ o’c 2 ' - P o' 


R 


s + q o’g 


(4. 15) 
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Equations (4. 12) and (4. 13) can be used to derive a number of relationships 
between v and /3 similar to equation (4. 15) , depending on which parameters 
are assumed to be known and which are unknown. 

4.3.1 A Special Safety F actor Definition 

For the subsequent work in this research and for convenient application 
of the results, it is desirable to use a particular definition of design safety 
factor. Although the definition to be used here has not previously been explicitly 
stated, its use has been implied in many situations in civil and aerospace 
engineering. In fact, in deterministic design approaches the implied use of such 
a definition is probably the rule rather than the exception in the design of most 
structures. This definition is 


v = 


R 

S 


(4.16) 


where R is the strength of the structure calculated by the analyst, S is a so- 

ro f'-'J 

called limit load, and v is the design safety factor. Very often in the past, S 
has been statistically determined as 


S = S + qa g 


(4. 17) 


where S is the mean load, is the standard deviation, and q is a constant. 

b 

/v 

Much less frequently, R has been statistically defined, and in many cases 
where this has been done, consideration of factors affecting strength variability 
has been limited. For example, in many analyses the variance in R has been 


i 


I III mi 
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assumed to be due only to scatter in material properties. As will be seen in 
subsequent chapters, scatter in material properties is a relatively minor con- 
tributor to the variance in R. A key assumption in this research is that R is 

r*i 

not defined as R - p ov, . R is defined as the strength predicted by the analyst. 

xt 

ru 

The relationship of the deterministic quantity R to the mean value will depend 
upon the type of testing (test option) contemplated. Consequently, the probability 
that the strength will be less than R is different for each test option. This is 
illustrated in Figure 5 where R , the analyses predicted strength, is 100 percent 
for each test option,. 

Furthermore, it will often be convenient to use the coefficient of variation 
of load rather than the standard deviation: 



where y is the coefficient of variation. Equation (4. 17) becomes 
b 

S = S + q S y g = S( 1 + q y g ) 

Equation (4. 16) can then be written as 
~ R 100 

V = — = — > 

S(l+qy g ) S(l+qy g ) 


(4.18) 


(4.19) 


(4.20) 


where S is expressed as a percentage of the design ultimate load. Equation 
(4. 20) is the objective of the entire development in this section and will be used 
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extensively in the computations in subsequent chapters. The design safety factor 
v is illustrated graphically in Figure 8. As has been previously mentioned, the 
design safety factor establishes the location of R relative to S , and hence in 
effect, controls the design for a known load distribution. The opposite view- 

rsi 

point can be taken. The factor v can be considered to establish the permissible 
loading which can be applied to a given design with strength R (characterized 
by R). 



Figure 8. Special Design Safety Factor . 
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CHAPTER V 

ANALYSIS OF SUBJECTIVE EXPERT OPINIONS 

Helmer [89] made the following observation: 

While model-building is an extremely systematic expedient to pro- 
mote the understanding and control of our environment, reliance on the use 
of expert judgment, though often unsystematic, is more than an expedient: 
it is an absolute necessity. Expert opinion must be called on whenever it 
becomes necessary to choose among several alternative courses of action 
in the absence of an accepted body of the theoretical knowledge that would 
clearly single out one course as the preferred alternative. 

The use of subjective expert opinion is as old as civilization, but systematic 
methods have largely been restricted to application with observed data. Helmer's 
purpose was the systematic collection of expert opinions through a method called 
the Delphi technique. The distinguishing feature of this technique is that a 
sequence of questionnaires is sent to the experts, and each questionnaire in the 
sequence is based on information from the previous questionnaires. The 
respondents are thus made aware of the opinions of other experts and are en- 
couraged to make use of these opinions in formulating new responses or revising 
previous responses. 

Since each questionnaire in the Delphi technique is based on previous 
responses, the model for analyzing results must necessarily be loosely defined. 

A more rigorous model for analyzing subjective information with respect to pre- 
dicting the future was presented by Gordon and Hayward [ 90] and Enzer [91] . 
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This model, the cross-impact matrix method of forecasting, permits the 
probability of each event in a forecasted set to be adjusted in view of judgments 
relating to potential interactions with the other forecasted events. This is 
accomplished by determining the probability of each event, conditional upon the 
occurrence of each of the other events. The effect of the events on each other 
is called cross impact and is often ignored in less rigorous methods. 

The foregoing developments were adapted and applied to the social 
sciences. Nair, Shah, Smith, and Shah [82] used a probabilistic model to study 
the technical problem of oil spills in the seas. They used expert opinions, 
gathered through mail questionnaires and personal interviews, as input to the 
model. The investigators were able to construct a probabilistic model of spills 
with respect to size, cause, and location. 

5. 1 Bayesian Viewpoint of Subjective Information 
An overall appraisal of the Bayesian viewpoint in statistics was eloquently 
presented by Savage [84], McGee [3], Papoulis [92], and Zellner [93] gave 
excellent presentations on the adaptation of these concepts to probability analysis. 
Tribus [1] related the Bayesian viewpoint to a broader spectrum of ideas, 
including the rational description of problems and use in design. A complete 
decision methodology based on the Bayesian viewpoint was constructed by Pratt, 
Raiffa, and Schlaifer [21] . An orientation of Bayesian statistics to decisions in 
engineering problems was given by Benjamin and Cornell [2] . 

The Bayesian viewpoint originates in the concept of probability as an 
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individuals degree of belief rather than the traditional concept that probability 
must be interpreted as a relative frequency of occurrence. Thus, probability is 
a result of the encoding of the decision-maker’s personal belief into a plausibility 
(probability) measure. This is accomplished by assigning a real number 
between zero and unity to the event in question, which is then taken as a measure 
of the relative likelihood that the event will occur. An assignment of zero 
represents no likelihood of occurrence, and unity represents certainty of 
occurrence. An assignment of 0.5 represents an equal likelihood of occurrence 
and nonoccurrence. Note that if the individual has no information available to 
him other than a measured relative frequency of occurrence in an experiment, it 
would be unreasonable for him to assign a probability other than the measured 
relative frequency. In this sense the "frequentist” concept of probability is a 
special case of the Bayesian concept. 

The Bayesian concept of probability leads to the conclusion that all 
available information should be used in making probability estimates. This 
information may be objective, subjective, or both. Bayesian statistical methods 
have been devised [ 1] , [3] , [93] which permit the consolidation of both types of 
information into probability estimates. An application of such methods is used 
in Chapter VI. 

The real strength of the Bayesian viewpoint lies in its applicability to 
decision methodology. Since a probability assignment represents the individual’s 
degree of belief based on all information available to him, the implication is that 
he should be willing to base his decisions on such probability assignments. On 
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the strength of this implication, a formal decision procedure which permits the 
use of Bayesian statistical methods in statistical decision theory has been devel- 
oped [21], which makes consistent use of the decision-maker's probability 
assignments. The method is discussed in Chapters in and VII. 

5.2 Mail Questionnaires 

Given that subjective information is appropriate for use in decision 
methodology, the questions arise as to how such information is best obtained 
and formulated in a manner suitable for use in decisions. In the present research 
there is a need to determine a strength distribution for test option T 3 for which 
no observed data are available. The existing state-of-the-art in obtaining such 
a distribution would be to guess or to consult with experts and then guess. The 
objective in this chapter is to develop a methodology to systematically obtain 
unbiased subjective expert opinions, statistically analyze these opinions, and 
obtain probability distributions for strength to be used in applications in later 
chapters. 

Two questionnaires (Appendix B) were devised to elicit the opinions of 
structural analysis and testing experts about strength distributions. Question- 
naire A was sent to approximately 55 supervisory and technical management 
personnel in industry and government, known by the author to have a background 
pertinent to the subject matter. This questionnaire was used to test the method 
of acquiring opinions, the probabilistic models, and the ability of experts to 
provide the type of information needed. It contained questions leading to strength 
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distributions of aerospace structures in a typical development program before 
test results are available. The experts' opinions were compared with some 
available observed data to determine the validity of results. 

After preliminary analysis of Questionnaire A results. Questionnaire B 
was sent to approximately 30 respondents of Questionnaire A. To assure 

, ‘ - i ■ ■ ■ 

validity of results, Questionnaire B was identical in format to Questionnaire A 
but contained questions leading to a strength distribution for structural assemblies 
developed through an extensive model and small component development test 
program, test option T 3 . No observed data are available for this case, and the 
subjective expert opinions are the only source of information for obtaining the 
needed strength distribution. 

An attempt was made in sending out the questionnaires to follow techniques 
which had proved to elicit a high percentage of responses. Such techniques are 
discussed by Bauer and Meissner [94], Campbell and Katona [95] , Jeanne and 
Gullahorn [96] , and Parten [97]. Hints provided by these authors include careful 
and precise construction of questions, minimization of writing required of 
respondents, appearance and neatness of the questionnaire, transmittal by 
personal letter on prestigious letterhead, enclosure of self-addressed stamped 
envelope, and pretesting of the questionnaire. Pretesting was accomplished by 
asking several faculty members to answer and comment on the questionnaire 
and then making changes based on the comments. 

Considering that the questionnaires were lengthy and that no tangible 
reward was offered for completing them, the response can be considered very 
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good. Thirty-nine of 55 copies of Questionnaire A were completed, and 19 of 30 
copies of Questionnaire B were completed. 

5. 2. 1 Verification of Metho d — Questio nna ire A 

Questionnaire A was so devised that two different approaches to calcu- 
lating a strength distribution from the responses could be used. For the situation 
described in the questionnaire, observed data were available from the Saturn V 
launch vehicle structures for direct comparison with the questionnaire results. 

A favorable comparison with the observed data would indicate that the expert 
opinions and the approach used were valid. 

The first approach utilizes only the response in Table 1 of the question- 
naire, which gives the experts’ overall views of the scatter in test failure loads as 
compared with the analysts’ predicted failure load. In the second approach, data 
in Tables 2 through 10 of the questionnaire are used to construct a counterpart to 
Table 1, which gives the same information as Table 1, but is constructed by use 
of a probabilistic model from the various causes which contribute to the scatter. 
The approach yielding results which compare more favorably with observed data 
can then be used to determine strength distributions for other circumstances 
when observed data are not available. 

Similar to the construction of the counterpart to Table 1, a counterpart 
to Table 3 could be constructed from the data in Tables 11 through 19 of the 
questionnaire to check consistency. 

Certain events related to the various entries were labeled in accomplishing 
the questionnaire analysis. Let L denote the event that a structural failure 
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occurs in load increment i, where i = 1, 2 . . . 10; that is, l t is the event 
that a structural failure occurs at less than 60 percent of the analysts 1 predicted 
failure load, \ is the event that a structural failure occurs between 60 and 70 
percent of the analysts 1 predicted failure load, ... I 10 is the event that a 
structural failure occurs at greater than 140 percent of the analysts 1 predicted 
failure load. 

If ~ < 60 percent Ig ~ 100 percent - 110 percent 

12 ~ 60 percent - 70 percent I T ~ 110 percent - 120 percent 

1 3 ~ 70 percent - 80 percent Ig ~ 120 percent - 130 percent 

1 4 ~ 80 percent - 90 percent I 9 ~ 130 percent - 140 percent 

1 5 ~ 90 percent - 100 percent I 10 ~ > 140 percent. 

Since failure of a given structure occurs in one and only one of these, 
load increments, the 1^ are always assumed to be a set of mutually exclusive 
and collectively exhaustive events. 

The event that a particular cause is the reason for a difference between 
predicted and actual strengths is denoted CL, where j = 1, 2, ... 8. For 
example, C 4 is the event that the analysts 1 mathematical model is a poor repre- 
sentation of the actual structure. All of the causes are listed in Table 2 of 
Questionnaires A and B, Appendix B. 

denotes the event that a particular discrepancy between the analysts 1 
mathematical model and the actual structure is the reason for failure, where 
k = 1, 2 . . . 8. The discrepancies are listed in Table 11 of the questionnaires. 


Appendix B. Note that the discrepancies are actually special cases or subcases 
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of cause number 1 in Table 2; that is, it is assumed that the eight discrepancies 

are the different reasons that the analysts’ mathematical model may be a poor 

representation of the actual structure. 

The first step in analysis of the results consists of combining the entries 

of the n respondents. This is accomplished by simply determining the mean 

response for each entry in each table. Let E represent any one of the table 

entries. Let E represent the entry of respondent p (p = 1, 2 n). The 

P 

value of the entry to be used in all further analysis is 


E 


e i + e 2 + 


+ E 


n 

l E r 


n 


_ P-1 


n 


(5.1) 


where E is the mean response. 

5.2. 1. 1 Probabilistic Models. Table 1 in the questionnaire represents 
the experts’ overall assessment of the strength distribution of the population of 
typical aerospace structural assemblies which have not been structurally tested. 
This distribution can be compared directly with the distribution determined for 
untested structures from Saturn V data in Figure 6 of Chapter IV. This compar- 
ison will be made later in this chapter along with a comparison with results from 
probabilistic models. 

Basic probability concepts as discussed in standard textbooks such as 
Benjamin and Cornell [2] and Hines and Montgomery [98] are used in construc- 
ting probabilistic models for analyzing questionnaire results. Three counterparts 
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to Table 1 of the questionnaire are constructed from the data in Tables 2 through 
10 through the use of conditional probabilities. In this context I. , C^, and 
are interpreted as events. The symbol P[A] stands for the probability that 
the event A will occur. The symbol P[A|B] stands for the probability that A 
will occur given that B has occurred. A n B (the intersection of A and B) is 
the event that both events A and B occur, and A u B (the union of A and B) 
is the event that either event A or B occurs. 

P[A|B] is called the conditional probability of A given B and is de- 
fined [2] as 


P[A|B] 


P[A n B] 
P [B] 


(5.2) 


This can be rewritten to give 


P [A n B] = P [A I B] P[B] 


(5.2a) 


Note that questionnaire A is devised so that an entry in Table 2 can be 
interpreted as P[C J since frequency of occurrence can be interpreted as a 
probability. Further, an entry in Tables 3 through 10 can be interpreted as 
P[lJ C.] since each entry represents the probability of a test failure in load 
increment i conditional upon a particular cause j. 

Then from equation (5. 2) , 


P[I. n C.] = Ptl.lC.] P[C.] 
1 J 1 1 J 


(5.3) 
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that is, the unconditional probability that a failure will occur in a particular 
load increment due to a particular cause is given by (5.3) . An interpretation of 
this is that PlX n C ] represents the probability that a failure will occur in 
increment i and that <X will be the reason for any difference between the 
actual and predicted failure loads. 

Three separate probabilistic models will be developed for determining 
the strength distribution by various methods of combining the eight causes of 
differences between actual and predicted failure loads. These models will be 
called X, Y, and Z, and the counterparts to Table 1 of the Questionnaire A con- 
structed from these models will be shown in Tables 2, 3, and 4 in this chapter. 

5. 2. 1. 2 Model X. In Model X the causes of differences between actual 
and predicted failure loads <X are assumed to be a set of mutually exclusive 
and collectively exhaustive events. This implies that any given difference 
between actual and predicted failure loads has only one cause, and by an axiom 
of probability, 

8 

PtCj] + P[c 2 ] + ... + P[C 8 ] = £ P[C.J = 1 . (5.4) 

j 1 3 

Since the mean responses to Questionnaire A, Table 2, do not conform to this 
axiom, the responses must be normalized. It should be noted that respondents 
were asked to answer based on the premise that causes could occur together, and 
this normalization violates that premise. It cannot be proved that the respondents 
would not have answered differently if they had been told that the causes were 
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mutually exclusive. Normalization is accomplished by taking 


P[C.] 

3 


P[C. ] 
F 



P[C. ] 
F 


(5.5) 


where is the mean response opposite cause j (Table 2 in Question- 

naire A) o This normalization is illustrated by the Venn diagrams of Figure 9. 

Since no two causes occur together in general, they do not occur together 

within a given failure load increment i. Therefore, the event I. n C. excludes 

i 3 

any other event I.nC.J^io This means that the events 1. n C. and I. n C, 
^ i i J i ] i i 

are mutually exclusive and by an axiom of probability [2], 


8 

P[(I.n c x ) u (I. n C 2 ) u ... u (I. n C g ) ] = £ P[I. n C.l = P[IJ 1X 

(5.6) 

where P [I. ] denotes the probability of failure in increment i for Model X. 

1 1A. 

In words, the probability of the occurrence of failure in a particular increment, 
i, due to all causes is the sum of the intersection of I. with each of the causes 
[as calculated from equation (5.3)1. But the probability of occurrence of I 
due to all causes is precisely what was requested of respondents in Table 1 of 
the questionnaire. Thus, it is clear that Table 2 can be constructed through 
equations (5.3), (5.5) and (5.6), which should compare favorably with Table 1 
of the questionnaire and the observed data to validate the model and the experts' 
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responses in Tables 2 through 10, Questionnaire A. 

An example may be instructive. Suppose it is desired to calculate the 

entry for column (6) in Table 2 to compare with Table 1 in Questionnaire A. 

The entries in column (6) (P[I 1 C . ] ) of each of the Tables 3 through 10 in the 

6 J 

questionnaire would be multiplied by the corresponding frequency of occurrence 
(P[C.l) from normalized entries in Table 2 of the questionnaire according to 
equation (5.3) . The resulting products are then summed according to equation 
(5.6) to obtain the entry, P [I ] 1V , in column (6) for Table 2. 

These computations have been carried out for each load increment i and 
the results are shown in Table 2. 

Table 2. Failure Probabilities for Model X 


I. 

l 


(1) 

(2) 

(3) 

(4) 

(5) 

(6) 

(7) 

(8) 

(9) 

(10) 


60- 

70- 

80- 

90- 

100- 

110- 

120- 

ISO- 


<60 

70 

80 

90 

100 

110 

120 

130 

MO 

>140 

0.040 

0.054 

0.084 

0.134 

0.242 

0.206 

0.120 

0.068 

0.034 

0.018 


These data will be compared with the Saturn V observed data along with the other 
models later in this chapter. 

5. 2. 1. 3 Model Y. In model X the causes were assumed to be mutually 
exclusive and collectively exhaustive. It may be possible that more than one 
cause could be a contributor to a given difference in predicted and actual failure 
load. This eventuality was considered in constructing the revised Table 2 in 
Questionnaire A by permitting the responses to total 100 percent or more. If 
two causes j and k are not mutually exclusive, then they may have a joint 
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occurrence C n C, . In Model Y the probability of this joint occurrence is 

j k 

considered in each of the failure load increments i. A Venn diagram depicting 
this condition is shown in Figure 10, where only two causes are shown for clarity. 
The intersections of these causes with the mutually exclusive and collectively 


exhaustive events I. are also shown. Now consider the relationships existing 


within a given load increment i. This is illustrated in Figure 11, where only 


two causes are shown for clarity. In the following derivation it is assumed that 


all causes and the intersection of any two causes may exist but that intersections 


of three or more causes are negligible. 


From the Venn diagram. Figure 11, and generalization to eight causes, 


8 8 8 

P[l] = £ Plc nil - - 5 - Z S Ptc.nc nil (5.7) 

1 j=l 1 1 2 j=l k=l 3 k 1 

j#k 


If the causes are assumed to be independent within i, 


p[C.n c, n I.] = P[C. n I.] P[C. n I.] (5.8) 

] k i j x k i 


From the definition of conditional probability [2] , 


PlC.ni.] = Ptl.lCj P[C.] (5.9) 

J i i J J 


From (5.8) and (5.9), 


P[C.n c, n I.] = Pfl.lC.] P[C.] P[I. ■ . ] P[C. ] 
j k l i ] j x k k 


(5.10) 
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Substituting (5.9) and (5„10) into (5.7), 



Since I. are mutually exclusive and collectively exhaustive events, 

10 

Y/P[I.] = 1 . (5.12) 

ML 1 

Now the quantities P[C.] are precisely the quantities represented by entries in 
Table 2 of Questionnaire A, and the quantities P[I.|C.] are represented by 
entries in questionnaire Tables 3 through 10. If the mean responses to Question- 
naire A are substituted into equation (5. 11) and the summation of P[I ] is taken 
as indicated by equation (5. 12) , then 

10 

Y P[I.] = 1. 207 * 1 . (5.13) 

ML 1 



Figure 10. Venn Diagram for Inter secting Causes. 
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Figure 11. Intersection of Causes with Load Increment. 

This result indicates that the assumption of independence of causes is not 
compatible with the questionnaire responses. Note that the assumption of 
independence was involved in writing equation (5.8) . Assume that a factor a 
exists which accounts for the dependence among causes such that 

PlC.nc ni,] = aPlC.nl.] P[C, nlj . (5.14) 

j k l ] l k i 

Then, in place of equation (5.11) there results 


8 8 8 

p[i.l = fj Pd.ic.i p(c.] T T pti.ic.) ptc.l Pd.ic.l p[c, ] . 
1 3=1 1 j J 2 j =1 & 1 J ] 1 k k 


Substituting this result into equation (5.12) 


(5.15) 




99 


10 8 10 8 8 

E % PII.IC.1PIC ] - f E‘Z E Ptijlc JPtC ]P[I 1C JPtC ] = 1 , 

i=l j =1 1 3 1 * i=i j=i k=l 3 3 

(5.16) 

from which 


10 8 

J, Tj Pfl.IC.l P[C.l - 1 
1=1 j=l J J 


| E E ^ PUilc.lPICjlPdjIc^plc^ 


Once a; has been determined from equation (5.17) the desired results P[I. ] 
for model Y can be determined from equation (5. 15) . These computations have 


been carried out for each load increment i, using mean responses from 


Questionnaire A to obtain the results shown in Table 3. 


Table 3. Failure Probabilities for Model Y 







I 

i 






(1) 

(2) 

(3) 

(4) 

(5) 

(6) 

(7) 

(8) 

(9) 

(10) 



60- 

70- 

80- 

90- 

100- 

110- 

120- 

130- 



<60 

70 

80 

90 

100 

110 

120 

130 

140 

>140 

PtVlY 

0.049 

0.065 

0.095 

0.140 

0.183 

0.201 

0. 125 

0.079 

0.042 

0.023 


These data will be compared with Saturn V objective data later in this chapter. 

5.2.1o4 Model Z 0 A third probabilistic model was constructed, for 
which the development and discussion is identical to that for Model Y through 
equation (5. 13) . At that point instead of assuming a factor a to account for 
dependence of causes, the sample space is normalized by scaling both the causes 
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and intersections by a constant factor X. Thus, in model X intersections were 
assumed to be zero, and probabilities of causes only were scaled; in model Y, 
probabilities of intersections only were scaled, and in model Z , probabilities of 
both causes and their intersections were scaled. 

If model Z is applied to equation (5. 11) , there results 


. 8 

pu.i = x ( z pu.icjpic. 

3=1 J J 


= X (A. - B.) 

l l 


Substituting this result into (5. 12) , 


8 8 


] - 


| f, f, PII.1CJPIC.1PII.IC.1PIC,]) 
2 i=i k^l 1 ] 3 1 k k ' 

(5.18) 


j= 1 


10 . 10 10 
Z P[ V = X (2 A i - Z B i) = * (A -B) = 1 


10 

l 

i=l 


10 

Z 

i=l 


(5.19) 


Solving equation (5.19) for the value of X required to normalize the sample 
space, 



Once X has been obtained, P[lJ can be calculated from equation (5. 18) . These 
computations have been carried out for Questionnaire A, and the results shown 
in Table 4 were obtained. 


5.2. 1. 5 Comparison with Observed Data. Three probabilistic models 


I 
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Table 4. Failure Probabilities for Model Z 


(1) 

(2) 

(3) 

(4) 

I. 

(5) (6) 

(7) 

(8) 

(9) 

(10) 


60- 

70- 

80- 

90- 

100- 

110- 

.120- 

130- 

140- 

<60 

70 

80 

90 

100 

110 

120 

130 

140 

150 

0.042 

0.057 

0.087 

0.136 

0.226 0.204 

0. 121 

0.071 

0.036 

0.019 


of the strength distribution for untested structures have been constructed from 
the experts’ responses to Questionnaire A in Tables 2 through 10. In addition, 
the experts' overall assessment of what the strength distribution should be is 
given directly by the response in Table 1 of Questionnaire A. In this section, 
the resulting four strength distributions will be compared with the strength 
distribution from the Saturn V observed data shown in Figure 6, Chapter IV. 
This will accomplished by a Chi-square test comoarison of each of the four 

strength distributions with the observed data and a visual comparison of CDF’s. 

A summary of how the Chi-square test is being used here and in Chapter 
IV may be helpful. First, in Chapter IV, a two-parameter Weibull model is 
hypothesized to represent the Saturn V observed data, and the parameters of the 
distribution are calculated by the maximum likelihood method. A Chi-square 
test is then made by comparing the Saturn V observed data with the hypothesized 
model. Next, in this chapter, the same Weibull model is hypothesized to 
represent the data from one of the models of subjective expert opinions, and the 
hypothesis is checked by the Chi-square test. 

For the Chi-square test, six load increments with a minimum of five 
expected failures in each increment are considered. The test will give a 

II 
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measure of the difference in the number of structures expected to fail in each 
load increment from the distribution determined by observed data versus the 
number expected to fail in each increment from the subjective data. Let S. be 
the number of structures from the total of 50 structures expected to fail in 
increment i from the subjective data and Cb be the corresponding number from 
the distribution calculated from the observed data. The D t statistic is defined 
[2] as 


k (S. - O.) 2 

Di = £ - 'q ' ~ » k = 6 . (5.21) 

i=l i 


This statistic is compared with tabulated values of the Chi-square distribution 
[2] to determine the significance level at which the subjective and observed 
data agree; that is, 


P[D > * *a,k-l J = “ 


(5.22) 


where y , , is the value of the Chi-square random variable with k-1 degrees 
, k-1 

of freedom and cumulative distribution a . The value of a is known as the 
significance level and is a measure of the agreement between the hypothesized 
model and subjective data. 

Calculation of the Dj statistic for each of the four subjective models and 


determination of the significance level from standard tables (five degrees of 
freedom) yielded the results shown in Table 5. 
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Table 5. Results of Chi-Square Test 

Overall Model X Model Y Model Z 

Assessment 

d t Statistic 4.9 14.1 12.8 13.4 

Significance Level 42% 1.5% 2.5% 2.0% 

This indicates a very good fit for the overall assessment and a mediocre fit for 
the models. 

Cumulative distribution functions are shown in Figure 12, where the 
Weibull model of observed data from Chapter IV is shown by the solid line, the 
experts’ overall assessment by the dotted line, and an envelope of the three 
probabilistic models of experts’ assessment from causes by the cross-hatched 
area. 

It is evident from these results that the experts’ overall assessment is 
far superior to the distribution determined from probabilistic models based on 
experts’ opinions of causes. To establish the reason for this would require 
additional questionnaires and analysis of the results. With the information now 
available it cannot be clearly established whether there is an intrinsic ability of 
experts to provide a better overall assessment or whether the questionnaire and 
probabilistic models could be improved to a point where the model results would 
be as good as the overall results. However, it is known that all of the experts 
consulted have had occasion to directly observe data applicable to the overall 
assessment. It is not known how many of these experts have directly observed 
data applicable to the assessment from causes. 
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R, STRENGTH - PERCENT OF ANALYST'S PREDICTION 


Figure 12. Comparison of Observed and Subjective CDF’s. 

The simplicity of the overall assessment compared with the assessment 
from causes could also have been a factor. The latter required considerable 
time and deliberation and possibly a reordering of information from a form 
available to the respondent to that required to answer the questionnaire. Some 
respondents may have been unwilling to spend sufficient time to do this carefully. 

It should be mentioned that, although the model results are not nearly as 
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good as the overall assessment results, the model result significance level is in 
a range sometimes accepted by statisticians in the absence of better information. 
A significance level sometimes accepted is 1 percent, and the model results fall 
within that criterion. 

5.2.2 Strength Distribution for T 3 - Questionnaire B 
The primary objective of Questionnaires A and B was to determine a 
strength distribution for test option T 3 , the model test option. The analysis of 
Questionnaire A results in the previous section demonstrated the ability of 
experts to predict strength distributions and established that the overall assess- 
ment is likely to give better results than the probabilistic models of causes. 
Therefore, the experts T overall assessment. Table 1 in Questionnaire B, was 
used to determine a strength distribution for test option T 3 . This was accom- 
plished by fitting a two-parameter Weibull model to the data (mean responses) in 
Table 1, Questionnaire B. 

Each percentage point in the mean response was interpreted as one data 
point, and the resulting data were input into the computer program by Hanagud 

_ ^ A 

[87]. Maximum likelihood estimates v= 109.4 and k=8.8 were determined 
for the parameters of the Weibull distribution. 


f R (r) = 7 !) 


k-1 



(5.25) 


A significance level of 60 percent was obtained in a Chi-square goodness -of -fit 
test between model and data, using 10 increments of equal probability. A 
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comparison of CDF's of the model and the subjective data is shown in Figure 13 o 



R, STRENGTH, PERCENT OF ANALYST'S PREDICTION 


Figure 13. Comparison of Subjective Data and Weibull Model. 

In Figure 14 the strength distribution that can be realized by test option 
T 3 is compared with the distributions that can be realized by T 0 and T l0 The 
comparison is intuitively appealing. For the Model Test Option, T 3 , the frequen- 
cies of both grossly overstrength and grossly understrength structures are re- 
duced as compared with No-Test Option, T 0 , resulting in a distribution sharply 



60 80 100 120 140 160 

R, STRENGTH, PERCENT OF ANALYST'S PREDICTION 

Figure 14. Comparison of Strength Distributions, 
peaked near the analyst’s predicted value. Note that this is in contrast to the 
Standard Test Option, Tj, for which it was assumed that design changes are made 
only in understrength structures, and overstrength structures remain a part of 


I 
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the population. The strength distribution given by equation (5.23) and plotted in 
Figure 14 will be used for T 3 in all further analysis. 
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CHAPTER VI 

A BAYESIAN APPROACH TO UPDATING A STRENGTH DISTRIBUTION 

In this chapter, Bayesian statistics will be used to determine a strength 
distribution for test option Tj , the standard test procedure. Bayesian statistics 
provides a means of updating statistical distributions as new information becomes 
available. For the present analysis, test data accumulated during the laboratory 
structural testing of Saturn V structural assemblies are regarded as prior 
information, and the data obtained through flight experience are regarded as 
new information used to update the distribution determined from the prior 
information 0 

The Bayesian approach recognizes the validity of subjective information 
for use in probability analysis, and such information is used in determining the 
strength distribution for test option Tj . However, the effect of the subjective 
data on the distribution is relatively minor, and the resulting distribution can 
be regarded as primarily based on observed data. 

The method to be used will be developed through discussions of Bayes* 
theorem, the use of Bayes* theorem to combine new data with prior information, 
and the updating of the scale parameter of the Weibull distribution. Next, the 
method is applied to the Saturn V test and flight data to determine a two- 
parameter Weibull distribution for test option T t . The final distribution which 
can be realized by T t is obtained from the Weibull distribution by using a 


no 


Bayesian analysis to account for uncertainty in the scale parameter. 


6« 1 Bayes* Theorem 

A conditional probability of the event A given that the event B^. has 

occurred is defined as the ratio of the probability of the intersection of events 

A and B. to the probability of event B. and is denoted by P[A|B.J . 
j 3 3 


P[AlB.] 


P[An B.] 

L 

P[B.] 


( 6 . 1 ) 


from which 

P[A n B.] = P[A|B ] P[B.] 

3 j J 

Similarly, 

P[B. n A] = P[ B.IA] P[ A] 

3 3 

Since P[A n B.] s P[B.n A] , 

3 3 

P[ AIB.] P[ B J = P[B.|AJ P[ A] 
3 3 3 


( 6 . 2 ) 


(6.3) 


(6.4) 


Now following Hines and Montgomery [ 98] , if B^, . . . B^ represent a set 

of collectively exhaustive and mutually exclusive events, then an event A can 
be written as (Fig. 15) 


(6. 5) 


A = (A n B 1 ) u (A n B 2 ) u 


• • • 


u (A n B fl ) 



Ill 



Figure 15. Event A in Terms of Events B.. 


P[ A] = P[AnB ] + P[ A n B ] + ... + P[ A n B ] (6.5a) 

X a Q 

= ^ P[A n B.] . 

j ] 

Substituting equation (6.5) into equation (6.4), 


P[A I B.]P[B.l 

P[B I A] = 1 1- ( 6 .6) 

J l P[A n B ] 


Then from equations (6. 2) and (6. 6) , 


P[ A|B.] P[B.] 

P[B.|A] = ] 1 (6.7) 

J X HA|B k ] P[B k ] 
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Equation (6.7) is known as Bayes* theorem and provides the means of incor- 
porating new information with prior probability estimates to yield posterior 
probabilities. 


6. 2 Combining of New Data with Prior Information 
A continuous version (following Papoulis [92]) of equation (6.7) can be 
derived. Returning to equation (6. l) , let the event B. be the event 
{x < X s x + Ax} where X is a random variable, and x is a specific value of 
X . Then ( 6. 1) becomes 


P[A|x<X=£x + Ax] 


P[ A n x < X ^ x + Ax ] 
P[ x < X ^ x + Ax] 


Now by definition of the CDF, 

P[x<X^x+Ax] = F (x + Ax) - F (x) 

X X 

By definition of the conditional CDF, 


F x (x|A) 


P[X < x o A] 
P[ A] 


and 


F x (x 2 |A) - F x ( X;l IA) = P1x 1 <Xsx 2 |A] 

P[ A n x < X ^ x ] 

1 A 


( 6 . 8 ) 


(6.9) 


( 6 . 10 ) 


( 6 . 11 ) 


P[ A] 
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Substituting equations (6.9) and (6.11) into equation (6.8), 


P[ A | x < X ^ x + Ax] 


[ F x ( x + Ax|A) - F^xIA)] P[A] 

F x ( x + Ax ) - F x ( x ) 


( 6 . 12 ) 


Now 


lim 
Ax— -0 


[ F x (x + Ax) - F x (x) ] 
Ax 


i (, 

X ' 


and 


(6. 13) 


lim 
Ax— 0 


F x (x + Ax |A) - F x (x 1 A) 
Ax 


f (x|A) 
X 


(6.14) 


Now define. 


P[ A |X = x] = lim P[Alx < X == x + Ax] 
Ax— 0 


(6.15) 


Applying equations (6. 13), (6. 14) and (6. 15) to equation (6. 12), 


fJx|A) P[ A] 

PiAlX-x] =-S-W 

X ' 


(6.16) 


or 


P[ A | X = x] fjx) 

y x,A) ■ — ^ui — 


(6. 17) 



ill mi m i mi n 
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From equation (6. 16) we can write, 


00 CO 

f P[AlX=x] f (x) d x = f f (x|A) P[A] dx = P[A] (6.18) 

-00 -00 


Substituting for P[A] in equation ( C. 17) 

P[ A| X = x] f (x) 

y X |A) • (6.19) 

/ P[AlX=xJ y X ) dx 

—CO 


Equation (6. 19) is the continuous version of Bayes' theorem. In this expression 
let X represent a parameter of the distribution used to model the random 
variable of interest and A be a sequence of independent observations of the 
random variable. Thus, the theorem states that the distribution of the parameter 
X , given the observation A , is proportional to the product of the likelihood 
function P[AiX = x] , sometimes denoted L[X|A] , and the distribution of X 
f x (x) before the observations. The distribution y(x|A) , sometimes denoted 
f "(x), is called the posterior distribution of X, and f (x), sometimes denoted 

x x 

f ' (x) , is called the prior distribution of X. 

Incorporated in the above viewpoint is the idea that the parameter of a 
distribution is itself a random variable, a central concept in the Bayesian 
approach. This leads to the recognition that the distribution of a random variable 
such as a strength distribution, wherein the parameters are considered constant, 
does not fully represent the uncertainty involved with the random variable. A 
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complete representation of the uncertainty must allow for the recognition that 
the parameters of the distribution are not known with certainty 0 A method often 
employed to accomplish this is to use the parameter distribution given by 
equation (6. 19) as a weighting function on the PDF of the random variable and 
to integrate over the domain of the parameter to obtain a so-called predictive 
or Bayesian PDF of the random variable. Thus, 


f^y) = / f y (y) f x (x|A) dx , (6.20) 

X 

where f^Cy) * s distribution of the random variable Y , with parameters 

rsJ 

assumed given, and f^vy) is the Bayesian or predictive distribution of Y. 

The Bayesian distribution can be used to make inferences about as-yet- 
unobserved data and will include the uncertainty in the parameters as well as 
the uncertainty represented by f (y) . 


6. 3 Updating the Weibull Distribution 
Assume that the strength distribution for test option Tj is given by the 
two-parameter Weibull distribution, 



( 6 . 21 ) 


In the case of this strength distribution, the shape of parameter k will be 
considered constant (a condition which has been observed to be approximately 
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true for some physical phenomena) , and the scale parameter will be recognized 
as a random variable. For convenience, in this portion of the analysis the 
parameter X will be used in place of v . 

The Bayesian distribution of the strength distribution (6. 21) will now be 
obtained. From Soland [ 99] (also, see Section 4. 2. 2. 2) u the likelihood function 
of n observations of r in which (R^, ... R^) represent observations of 

failures and (R^ , • • • R Q ) represent observations of load levels in which no 

failure occurred (a censored sample) is 


£ £ 


L[X| k, R , . . . R ] = k X (R i R, 



( 6 . 22 ) 


For the present problem, equation (6. 19) takes the form. 


yw 


L(xlk, R x ... R n ) f A f (X) 

/Lf A '(x) dX 
A. 


(6.23) 


where F indicates a prior distribution, and f" indicates a posterior distribu- 
tion. The foregoing discussion emphasizes the fact that a Bayesian updating of 
a probability distribution is accomplished through an updating of the parameter(s) 
of the distribution. Note that the posterior distribution of the parameter is 
proportional to the prior distribution and to the likelihood function. The integral 
in the denominator can be interpreted as a normalizing constant. 
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Under certain restrictive conditions the mathematics indicated in equation 

* 

(6.23) need not be performed explicitly. It is mathematically convenient to use 
a distribution for the parameter A such that the operation indicated by (6. 23) 
results in a posterior distribution of A of the same form as the prior distribu- 
tion. Such a distribution of the parameter is called a natural conjugate of the 
likelihood function. 

Such a distribution for A (a gamma distribution) was displayed by 
Soland [ 99] : 

i t -1 -Ay 

f A (A) = , 0 =SA<co ; 0 < 4, and y < co , (6.24) 

where i and y are the parameters of the distribution, and T is the gamma 
function. Soland applied a Bayesian statistical analysis and decision methods to 
a problem of sampling electronic components for quality control. In the present 
research the application is to an updating of strength distributions for aerospace 
structural assemblies. 

If the parameters of the prior distribution f^’ (A) are y' and i’, and a 
sample of the Weibull process yields the likelihood function (6. 22) , it was 
shown by Soland [ 99] that the posterior distribution f A ’(A) has the parameters: 

y" = y* +y , (6.25) 

i»* = V + i 
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where 


y i 

y = L R j 

i=l 


(6.26) 


Through the use of the natural conjugate, the mechanics of updating are 
reduced to the reevaluation of parameters indicated in (6. 25) rather than the 
mathematical manipulations indicated in (6. 23). 

The Bayesian strength distribution, using (6.20), is 


f H (r) = / f E (r) 1 A (X) dX 


X=0 


(6. 27) 


® , i , k / ..i-1 -Xy 

r k-1 -Xr (y) X e 

= J xkr e ' rlT) 


dX 




® k-1 , . ■> / k v 

kr (y_) x t e -A(r + y) 


T(i) 


dX 


Integrating equation (6.27), 


? (r \ = k 1 (y/ £l* ± 1) = L k r*" 1 (y) £ 

R V * r(i) , k .i +1 . k ,/+l 

' (r +y) (r + y) 


(6.28) 


This is the Bayesian distribution of strength to be used in the decision process. 
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In equation (6. 28), r is the random variable, k is the shape parameter 
(assumed constant), and y and l are either prior or posterior parameters of 
the distribution of A . Thus, the problem of selecting a strength distribution 
reduces to obtaining a value for k and determining prior values y* and i' 
and data-based values y and i from which y” and i” can be calculated from 
equation (6. 25) and used in equation (6. 28) . 

6.4 Strength Distribution for T < 

The following step-by-step approach is deemed a reasonable procedure 
for using Saturn V test and flight data to determine values for k , i" , and y" 
for the Standard Test Option Tj. 

1. Determine the shape parameter k and prior estimates of y’ and f’ 
from static structural test data, with some subjective interpretations of the 
applicability of certain portions of the data. 

2. Determine data-based values of y and i from the flight successes 
of the Saturn V launch vehicle, using an approximation of the loads experienced 
during flight. 

3. Calculate posterior parameters y M and i” from equations (6.25). 
6.4.1 Saturn V Test Data as Prior Information 

An understanding of how the test option T t test procedure affects the test 
data presented in Table 1, Chapter IV, is required in describing step 1. Let 
the data in Table 1 be divided into two groups, I and n. Group I consists of 
structures 27 through 50 which failed or for which the test was terminated at 
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greater than 100 percent of design ultimate load. Group II consists of structures 
1 through 26 which failed to achieve design ultimate load. The Standard Test 
Option T t requires that no changes be made in the structures in group I and that 
all structures in group II be modified and retested to greater than design ultimate 
load. The modified and retested group (not shown in Table 1) is designated 
group III. The flight articles are built from the same specifications as the 
structures in groups I and m. 

Note now that all samples nominally identical to the flight articles have 
been tested to at least 100 percent of design ultimate load. Nevertheless, it is 
probable that some of the production flight articles would fail at less than design 
ultimate load if all flight articles could be tested, possibly because of the varia- 
tion in material properties, variation (within tolerance) of dimensions, or an 
occasional manufacturing error not evident in the test article. Questionnaire C, 
Appendix B, was used to obtain expert opinions on the probable percentage of 
redesigned structures which would fail in each of three load increments less than 
design ultimate load. The percentages predicted by the experts are given in 
Table 1, Questionnaire C, Appendix B. If these percentages are multiplied by 
the 26 structures in group II and rounded to the nearest integer number of 
structures, no structures are predicted to fail in increments 70- to 80- and 
80- to 90-percent, and two structures are predicted to fail in increment 90- 
to 100-percent of design ultimate load. These two data points will be as- 
sumed at the midpoint (95 percent) of the increment and will be designated as 
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group IV. Note that group IV could be regarded as a remnant of the original 
group n. 

The data base for the prior distribution for test option will be taken as 
groups I, ID, and IV. The data are tabulated in Table 6. In this chapter decimal 
fractions rather than percentages are used to avoid computations with extremely 
large numbers. The computer program by Hanagud [ 87] was used to estimate 
parameters of a two-parameter Weibull distribution model for the data in Table 

A A 

6. The maximum likelihood parameter estimates were k = 9. 27 and v = 1.265 
[ see equation (6. 21)] . Then 

A ■= v“ k = 1.265 -9 ' 27 = 0.113 (6.29) 

It will now be shown that this is also the expected value of X from equation 
(6. 24) using the same data. From equation (6. 26) , 

n 

y f = Yi 27 = 132.3 , (6.30) 

i=l 


where the r. are data in Table 6. Also from Table 6, i f = 15 is the number of 

l 

failures. The prior distribution of X from equation (6.24) is then 


y<A) 


„*15 /,xl4 -132. 3A 

(132.3) (A.) e 

T(15) 


0. 7632x10 


21 


. 14 -132. 3A 
A e 


(6.31) 


From Benjamin and Cornell [ 2] , the expected value of A is 



II 
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Table 6. Saturn V Test Data for Redesigned Structures 


Group 

Number 


Structure 

Number 


HI 


Failure 
Load, r. 

i 

(Fraction 
of Design 
Ultimate Load) 


1 

1. ooo+ a 

2 

1. ooo+ a 

3 

i. ooo+ a 

Q 

4 

1.000+ 

5 

1. ooo+ a 
1. ooo+ a 

6 

7 

1.000+ a 

8 

1. ooo+ a 

9 

1. ooo+ a 
1. ooo+ a 
1. ooo+ a 

10 

11 

12 

1. ooo+ a 

13 

1. ooo+ a 

n 

14 

1* 000+ 
1. ooo+ a 

15 

16 

1. ooo+ a 
1. ooo+ a 

17 

18 

1. ooo+ a 
1. ooo+ a 
1.000+ a 
1. ooo+ a 

19 

20 

21 

22 

1. ooo+ a 
1. ooo+ a 
1. ooo+ a 
1. ooo+ a 
1. ooo+ a 

23 

24 

25 

26 


Group 

Number 


Structure 

Number 


Failure 

Load, r. 

’ x 

(Fraction 
of Design 
Ultimate Load) 


IV 


27 

1. 000 

28 

1.000 

29 

i. ooo+ a 

30 

i. ooo+ a 

31 

1. ooo + a 

32 

i. ooo+ a 

33 

i. ooo+ a 

34 

i. ooo+ a 

35 

i. ooo+ a 

36 

1. 007+ a 

37 

1.007 

38 

1.013 

39 

1. 036+ a 

40 

1.072 

41 

1.072 

42 

1. 108 

o 

42 

1. 121+ 

44 

1. 130 

45 

1. 150+ a 

46 

1. 157 

47 

1. 180 

48 

1.250 

49 

1.313 

50 

1.513 

51 

0.950 

52 

0.950 


a. Censored sample 

b. Subjective data, Questionnaire C 
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E(A) 


11 _ 15 

y’ _ 132.3 


0. 113 


(6.32) 


As expected, this is the same as the maximum likelihood estimate, equation 
(6.29). 

Summarizing, the prior distribution of resistance R is the Weibull dis- 
tribution, equation (6. 11) with parameters k = 9.27 (assumed constant) and 
-l/k 

v=X = 1. 265. 


f R (r ) 


9.27 


(1.265) 


9.27 


8.27 

r 



(6.33) 


= 1. 0488 r 8 * 27 e~ 


0. 113 r 


9.27 


The prior distribution of X is given by equation (6.31). As indicated by 
equation (6.20), the uncertainty in X for purposes of decision analysis can be 
taken into account by determining the Bayesian distribution of r . The prior 
estimates of k, & , and y are substituted into equation (6.28) to obtain the 
prior Bayesian distribution, 


/V . . 

f R r ) = 


i'k r 


-1 (y') if _ 


, k .,*'+1 
(r + y’) 


9.252 x 10 


33 


8. 27 


, 9« 27 16 

(r + 132.3) 


(6.34) 


6.4.2 Saturn V Fli ght Success as New Data 

Since the method by Soland [ 98] (to be used to update the distribution) 
permits censored samples, the Saturn V flight data, which include no failures, 



II III ■ I 
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can be used as new information for updating the prior strength distribution 
which was established from laboratory test data only. There have been 13 
successful Saturn V flights, with each flight having 50 structural assemblies. 
This is a total of 650 assemblies that have been flown without failure. The 
opinion of experts on the loads experienced by these structures is given in 
Table 2 of Questionnaire C, Appendix B. The data in this table will be approxi- 
mated as shown in Table 7 for purposes of analysis. 


Table 7. Saturn V Flight Loads 
Flight Load — Percentage of Design Ultimate Load (R.) 



<30 

35 

45 

52.5 

57.5 

62.5 

68 

Percentage of 
Structures 
Experiencing Load 

15 

7. 22 

9. 22 

12.44 

20.22 

13.78 

22.11 

Number of 
Structures 

98 

47 

60 

81 

131 

90 

144 


Experiencing Load 

Using these data as new information and noting that the contribution of 
structures loaded to less than 30 percent will be negligible, the parameters of 
the posterior distribution of X can be calculated from equations (6. 25) and 
(6. 26): 


-■Z 


i=l 


R^ = 47(0. 35) 9 * 27 + 60(0.45) 


9.27 


(6.35) 


9.27 


9 


+ 144(0.68) 


6.2 
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y f = 132.3 from equation (6.30), 
i =0 (no flight failures) , 


i T = 15 ( 15 test failures) , 

y” = y + y » = 6. 2 + 132.3 = 138.5 , 

i" = i + i* = 15 . 


Then from equation (6. 24) , 


15 14 -138. 5A 

A f 

T (15) 


£^ W = (l38 - 5> - 1.519xl0 21 A 14 e- 138 ' a 


(6.36) 


The expected posterior value of A is 


E " (x > ' p ? = ’ °- 1083 


(6.37) 


and the expected value of the scale parameter v is 


E"(v) = [E"(A)] k = (0.1083) 9,27 = 1.271 


(6.38) 


The posterior distribution of r is then given by the Weibull distribution, equa- 
tion (6. 21) , with parameters k = 9. 27, v = 1. 271: 


9.27 


M r ) 


R 


9.27 8 

r 


(1.271) 


9.27 


,27 e -(l.27l) , 1 .0038r 8 - 27 e-°- 1083r9 ‘ 27 


(6.39) 
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The posterior Bayesian distribution is, from equations (6. 28) and (6. 35) , 


k-l l»» 

r.t( r v = 

R ir; , k 

(r + y") 


= 1. 841 x 10 


34 


8.27 


/ 9 *27 , no 16 
(r +138.5) 


(6.40) 


This is tne final strength distribution for test option T t to be used in the decision 
analysis. Differences between the prior distribution, equation (6.33); the 
Bayesian prior distribution, equation (6.34); the posterior distribution, equation 
(6.39), and the Bayesian posterior distribution, equation (6.40), are quite 
small. Some values of the distributions are shown in Table 8 to illustrate this. 
Plots of the distributions would all appear as shown by the Tj test option in 
Figure 16. 

The small differences between the Bayesian and non-Bayesian distributions 
indicate that there is sufficient data to make a reasonably accurate determination 
of the scale parameter. Even though there were a comparatively large number 
of flight structures and no failure occurred, the flight data caused only a small 
change between the prior and posterior distributions because of the low load 
levels in flight compared with the test loads. 

The improvement in strength that can be gained by testing according to 
test option T* is illustrated in Figure 16. The dotted line represents the 
strength distribution before the test and redesign cycle (derived in Chapter IV) , 
and the solid line is the distribution from equation (6.40) after the test, rede- 


sign, and retest cycle 
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Table 8. Comparison of Strength Distributions 


r x 10 2 

yw 


yw 

y( r ) 

20 

1.666 X 10" e 

1. 743 X 10 -6 

1. 664 X 10 -6 

1.665 X 10 -6 

40 

5.367 X 10" 4 

5.378 x 10" 4 

5. 136 X 10 -4 

5. 138 X 10 -4 

60 

0. 01533 

0.01536 

0.01467 

0. 01467 

80 

0.1633 

0. 1635 

0. 1564 

0. 1563 

100 

0.9366 

0.9318 

0.9008 

0. 8949 

120 

2.5657 

2.4973 

2.5209 

2.4538 

140 

1.3105 

1.3584 

1.3993 

1. 4414 

160 

0.007504 

0.03580 

0.01048 

0. 03473 


Prior Distribution: f ' (r) = 1.0488 r 8 9 * 27 e 9 * r 

A 


oo 8. 27 

33 r 

Prior Bayesian Distribution: f *(r) = 9.252 X 10 — — 

R (r 9 * 27 + 132.3) 16 


8* 27 — o. 1083 r 

Posterior Distribution: f"(r) = 1. 0038 r * e 

x\ 


9.27 


Posterior Bayesian Distribution: f’’( r ) = 1.841X10 

A 


34 


8. 27 


(r 9 * 27 + 138. 5) 16 
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Figure 16. Comparison of Strength Distributions for 
No- Test and Standard Test Options. 



CHAPTER VII 


THE DECISION MODEL 

In Chapter HI, it was shown how the decision to be made falls within the 
purview of Bayesian statistical decision theory. The fact that this is true 
negates the requirement for formal proof here that the decision procedure is 
valid. The validity has already been established by others in development of the 
theory. Entire volumes are devoted to the subject by Pratt, Raiffa, and 
Schlaifer [21], Raiffa [83], Morgan [100], Raiffa and Schlaifer [101], and 
Schlaifer [102] . A treatment sufficient for the present problem is included in 
Benjamin and Cornell [2] „ An essential feature of the theory is that expected 
costs of uncertain events, based on probability analysis, are treated in conjunc- 
tion with known or certain costs in determining a cost optimum decision. 

The structuring of the decision tree, accomplished in Chapter HI, will 
not be repeated in this chapter. Instead, a flow-chart description of the process, 
which may help to demonstrate some points that could not be shown on the 
decision tree, will be developed. Each element of the flow chart will then be 
examined separately in more detail . Care has been taken to assure that all 
assumptions and procedures in the flow chart are consistent with statistical 
decision theory. This chart should give a good idea of the interrelationships 
of the problem variables and should help to distinguish what information is 


I 
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treated as an integral part of the decision model as opposed to information 
needed as input to the model . 

Figure 17 illustrates the decision process. Consistent with statistical 
decision theory, the process is divided into three major elements: actions, 
state of nature, and values (or utilities) . Generally, actions represent alterna- 
tives available to the decision-maker, the state of nature represents factors 
(usually not known with certainty; which affect the consequences of the actions, 
and the values are numerical measures of the consequences of action-state 
combinations. 


7. 1 Action — The Decision to be Made 
The alternative actions or decisions are illustrated in the left portion of 
Figure 17. In the present problem, an action consists of two elements: 

(1) selection of a test option or method of testing from among four discrete 
alternatives and ( 2) selection of a design safety index from a continuous spec- 
trum encompassing (theoretically) all real numbers. The action is denoted by 

the symbol A. (/3 ) , where j represents the test option, and /3 represents the 
J 

safety index. For example, A 3 (1.5) denotes the decision to use test option 3 
and a safety index of 1.5. 

7.1.1 Selection of Test Option 

Clearly, one of the means available to the designer to control structural 
reliability is the selection of a method of testing. Testing tends to decrease 
uncertainties and design errors, thereby permitting the designer to more 
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accurately estimated the strength of the design. This affects the probabilistic 
strength distribution, which in turn influences the structural reliability. 

In Chapter IV, four possible methods of testing were described. In the 
present research, it is assumed that the designer is to make a selection of one 
of these discrete methods of testing (test options) and that the test option 
selected controls the shape of the probabilistic strength distribution of the design 
as shown in previous chapters. Since the strength distributions were basically 
derived from experience on aerospace structures built in the past, there is also 
an implication that the inspection procedures, nondestructive test procedures, 
and maintenance procedures for a given test option should be consistent with 
those on the past projects from which the data were obtained. Such procedures 
are usually designed to disclose errors and other anomalies which result in 
defective parts. It should then be expected that these procedures affect the 
strength distribution of the population of structural assemblies placed in service, 
since any defects discovered would be rectified. If the procedures in a new de- 
sign are not consistent with those in past projects from which the strength distri- 
butions were derived, there is reason to question the applicability to the new de- 
sign. This is emphasized on the flow chart by showing these procedures as an 
integral part of the test option. 

Test option T 2 , the proof test option, requires elaboration here. If T 2 
is selected as the test method, the choice of a proof test load level is also 
necessary. Five discrete levels of proof testing will be considered as a part 
of the decision space; that is, if the proof test option is selected, a proof test 
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level must also be selected to complete the decision. The proof test level 
will be expressed as a percentage of the design ultimate load. Figure 18 shows 
the matrix of test options. 


T 0 , N 0 - TEST OPTION 


T], STANDARD TEST OPTION 



50% PROOF TEST 


60% PROOF TEST 

t 2 , proof TEST OPTION 

70% PROOF TEST 


80% PROOF TEST 


90% PROOF TEST 

T 3 , MODEL TEST OPTION 



Figure 18. Matrix of Test Options. 

7.1.2 Selection of Safety Index 

A second means available to the designer to control structural reliability 
is the selection of a safety index. Once the safety index has been obtained, it is 
simple to convert the result to the safety factor in any given problem. In the 
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applications in Chapter VIII, both the safety index and the safety factor will be 
considered. 

Thus, the second element of the decision to be made is the selection of a 

1 

design safety index, /3. The domain of /3 is all real numbers. Negative 
values are physically and mathematically possible, but it seems unlikely that 
negative values would ever be useful in a real situation, since this implies that 
the expected strength is less than the expected load. 

7.2 State of Nature 
7.2.1 Load and Strength Distributions 

The state of nature is illustrated in the middle portion of the flow diagram, 
Figure 17. Basically, there are two ingredients which define the state of nature: 
(1) the structural assembly itself and (2) the environmental conditions to which 
the structural assembly is subjected. It is convenient to identify specifically the 
important characteristics of the structural assembly and the environmental 
conditions which are pertinent to the decision at hand. 

The important characteristics of the structural assembly are its strength 
and weight . As indicated in the flow diagram and discussed in previous chapters, 
the shape of the strength distribution IL depends upon the test option. Further, 
the final strength distribution (/3 ) depends on both the test option and the 
design safety index, since the design safety index is used to control the 
predicted strength of the design. Within a given test option and under the 
assumption that the basic configuration of the structural assembly is fixed, an 
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increase in the design safety index to increase the strength will result in an 
increase in the weight. The dependence of weight on the safety index is indicated 
in the flow diagram. 

The environmental condition of importance is the load distribution applied 
to the structure. As indicated in the flow diagram, the load distribution is 
assumed to be known and is considered as an input to the decision model. 

7.2.2 The Probability of Failure 

An important quantity which characterizes a given combination of strength 
and load distributions is the probability of failure. In this section, the procedure 
for calculating the probability of failure of a given structural assembly, sub- 
jected to n applications of identically distributed random loads, will be 
developed. The n applications of loads could represent n separate flights. 

The development here is consistent with that of Freudenthal , Garrelts , and 
Shinozuka [ 39] . 

Let F-r, (x) be the cumulative distribution function (CDF) of strength 

XV 

of a structural assembly and fg (x) be the probability density function (PDF) 
of the load to be applied to the assembly. By definition of the CDF and PDF, 

F r (x)=P[RSx] (7.1) 

and 

f g (x) dx = P [x ^ S £ x + dx] (7. 2) 

Thus, the probability that R will be less than x and that S will be in the 
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increment dx is 

P [R ^ x and x ^ S < x + dx] = P [E {R ^ x} n E {x ^ S ^ x + dx}] , 

(7.3) 

where E {} represents the event that the statement in the brackets is true. 

If R and S are assumed independent of each other, 

P [E {R < x} n E {x ^ S < x + dx}] = F„ (x) f 0 (x) dx (7.4) 

by the well-known product rule. Equation (7.4) represents the probability that 
R will be less than S when S is in a general increment dx. If the probability 
that R is less than S is desired for all possible load values, an integration 
over all values of x must be performed: 

oo 

P [R < S] = / F (x) f (x) dx (7.5) 

Note that P [ R < S ] represents the probability that a structural assembly with 

CDF F^ (x) will fail because of a single application of load from the distribu- 

th 

tion f (x) . Thus, the probability of failure on the k application of load is 
S 

oO 

p (k) s P [R < S] = / F (x) f c (x) dx . (7.6) 

f o R s 

th 

There are assumed to be only two possible outcomes on the k load 
application, failure or survival. Since the probability of failure is given by 
equation (7.6), the probability of survival, from an axiom of probability, is 
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p f (k) = 1 - p f (k) . (7.7) 

The probability that the assembly will survive n load applications is 
L n (n) = P o E 2 n . . . n E fc n . . . n E^J , (7.8) 

where E^ denotes the event that the assembly survives the load application, 

and the intersection E . n . . ,nE denotes the occurrence of all events 

1 n 

E^ . . . E q . If the survival of each of n load cycles is independent of the 
survival of all other load cycles , the probability of E n . . . n E^ , and hence 
the probability that the assembly will survive n load applications, is 


L n (n) = p f ( i) p f ( 2) . . . p f (k) . . . p f (n) 

= ||i - p f (i)J £i - p f (2)J ... |^i - p f (n)J 
n 

= T1 fi-p (k)l . (7.9) 

k=l L J 

Since the n applied loads are identically distributed, p^ (1) = p^ (2) = . . . 

= p f (n) , and 

L N (n) = [l-Pf (k)] U (7.10) 

The probability of failure of the structural assembly during the n load applica- 
tions is 

F n (n) = 1 - L n (n) = i - [i - p f (k)J n = 1 - £p f (k)J “ (7. ii) 


II 
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Similar results were obtained by Freudenthal, Garrelts, and Shinozuka [39] . 

A special case of equation (7.11) arises for the consideration of the 

i 

application of a single deterministic load such as a proof test load. Let the 
magnitude of the deterministic load be r 0 . Then, in place of equations (7.4) 
and (7.5) , 

p[r<s]=p[e j BS r 0 } n E js»r 0 j] =F R (r 0 ) , (7.12) 

from equation 

(7.1). Then the probability of failure during proof testing is 

p f (p)=p[R<s] = F E (r 0 ) . ( 7 . 13 ) 

If m identical structural assemblies are to be subjected to the proof test, the 
probability that one or more of these articles will fail the proof test is given by 


where 


1 and P 


F R ( r c 



(7.14) 


7.3 The Cost Model: Uti lities 

In Bayesian decision theory, utilities or values are, in general, a 
measure of the consequences of various action/ state-of-nature combinations . 

The proper expression and use of the utility concept has absorbed a considerable 
portion of the development of the theory. The present problem requires the use 
of only the very elementary concepts of utility, and these have a very high degree 
of intuitive appeal . The utility concepts to be used are described below and are 
consistent with Bayesian decision theory. 
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The measure of utility is very direct — the expected cost in dollars of 
action/state-of-nature combinations is used as the measure of desirability of 
the combinations. The lower the expected cost, the higher the desirability. 
Expected costs include not only direct monetary outlays but also the monetary 
equivalent of other consequences such as performance loss due to weight of the 
structural assembly (assumed to be deterministic) and possible monetary losses 
due to structural failure (assumed probabilistic) . As would be intuitively 
expected, any costs common to all possible actions may be omitted from 
consideration. This is equivalent to saying that the choice of reference point 
does not affect the decision. As indicated in Figure 3 of Chapter in, direct 
costs (costs not affected by the state of nature) may be considered directly 
and need not be included in the utility function. However, these costs could 
be included in the utility function, and the final results would not change. 

The total expected cost to be minimized to obtain the optimum decision 
consists of three basic parts: direct costs C D , cost of weight , and 
expected cost of failure C^, : 


C = + C 

D w 


+ C_ 


(7.15) 


Each of these cost constituents will be discussed separately. 

7.3.1 Direct Costs 

The direct costs do not depend upon the state of nature but may depend 
upon the action. As shown in the flow diagram of Figure 17, these costs include 
such items as development costs and operational costs C 0 . 


The notation is used in the flow diagram to indicate that these costs 

j 

primarily depend upon the test option selected. The development costs include 
such items as test hardware, test facilities, and test operations, including an 
allowance for correcting deficiencies which may be discovered in testing. 
Operational costs include items such as inspection, nondestructive tests, and 
maintenance. In the area of direct costs, it is particularly important to keep in 
mind that costs common to all actions need not be considered; this can signifi- 
cantly reduce the amount of information required as input to the decision model. 
For example, if all courses of action under consideration require the use of 
the same test facility, the cost of the facility need not be included in the cost 
model. 

7.3.2 Cost of Weight 

Weight is usually of prime importance in aerospace systems. In fact, 
this is the basic reason that aerospace systems are usually designed with much 
smaller safety factors than civil structures. However, weight does not have 
equal importance in all aerospace systems. It is not unusual for the monetary 
value of weight to vary by an order of magnitude between the first stage and the 
upper stages of a launch vehicle. This important fact has been largely disre- 
garded in the past in establishing structural criteria such as safety factors. 

The value of weight can easily be included in the present decision model. 
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Within a given design concept, the weight of a structural assembly 
largely depends upon the design safety index. Let the weight relative to some 
reference value be a known function of the design safety index: 

W = W(J3) (7.17) 

Let the known monetary value of one unit of weight in the assembly under consid- 
eration be c^. Then the cost of weight as a function of /3 appropriate for use in 
equation (7.14) is 

C = C (/3) = c W(/3) . (7.18) 

WWW 

7.3.3 Exp ected Cost of Failure 

In Benjamin and Cornell [2] , it is shown that the expected cost of an 
uncertain event is given by the product of the actual cost of the event and the 
probability that the event will occur. In the present context, the uncertain event 
is the failure of the structural assembly under consideration. Note that the 
probability of failure derived in equation (7. ll) is the probability of having one 
or more failures. The possible events that can occur during the application of 
n load cycles to a fleet of structural assemblies are no failures, one failure, 
two failures ... or n failures. According to statistical decision theory [2] , 
the expected cost of these mutually exclusive events is 

C F “ °0 P 0 + °1 P 1 + C 2 P 2 + - + C i P l + - + C n P „ • < 7 - 1SI > 
where C. is the cost of i failures, and P. is the probability of having exactly 
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i failures. 

From equation (7.6) and (7.7) , the probability of having a failure on the 
til 

k load cycle is p.(k) , and the probability of no failure is p f (k). The prob- 
ability of no failures in n load cycles, P Q = ^(n) , was given by equation 
(7.10) . Assuming independence of the events of failure, the probability of sur- 
viving the I s *, 2 DC * . . . (i-l)** 1 , (i+l)** 1 . . . and n** 1 cycles and having a failure 
on the i** 1 cycle is given by 

= P f (l)P f (2) ... p f (i-l)p f (i)p f (i+l) ... p f (n) . (7.20) 

i.1. 

Similarly, the probability of failing on the j n cycle but surviving all others is 

P. = P f ( 1 )P f (2) ... P f (j-l)p f (j)p f (i+l) ... P f (n) . (7.21) 

st 

Note that the failure events, E{ failure on the 1 cycle, survival of all other 

n.d 

cycles}, E{ failure on the 2 cycle, survival of all other cycles} ... E{ failure 
th 

on the n cycle, survival of all other cycles} are mutually exclusive. Then, by 
an axiom of probability [2] , the probability of any one of these events occurring 
is 


n 

Pj = Pj + Pg + ••• + Pj + • • • + P n = Pj * (7.22) 

i=l 


where P^ is the probability of having exactly one failure. Substituting fcion 
(7.20) into equation (7.22) and assuming p f (l) = p { (2) = . . . p f (k) . . . = p f (n) , 
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P 1 = tp f (k)] n-1 p f (l) + [p f (k)] n_1 p f (2) + ... + [p f (k)] Q J p f ( i) (7.23) 

+ . . . + [p f (k) ] n_1 p f (n) = n p f (k) [p f (k) ] n_1 

th th 

Similarly, the probability of having failures on the i and r cycles and 
surviving all other cycles is 

P^ r = Pf( 1 ) p f( 2 ) ••• P f ( i- 1 ) P f ( i) P f ( i+ l) ••• P f ( r -l) P f (r)p f (r+1) ... p f (n) . 

(7.24) 

If all possible combinations of i and r are considered, the probability of 
having exactly two failures is 

P 2 = [ Pf( k ) ]I1_2 Pf( 1 )Pf( 2 ) + [P f ( k )l n ~ 2 P f ( 1 )P f ( 3 ) + ••• (7.25) 

+ [p f (k)] n_2 p f (i)p f (r) ... + [p f (k)] n-2 p f (n-l)p f (n) 

=£ 4t 1) tp f ( k )i 2 [p f ( k )i n_2 • 

Generalizing equation (7.23) and (7.25), 

V qlfn-ai IP t ( k )l q [?j( k )l“" q • (7-26) 

Equation (7.26) is recognized as the well-known binomial distribution [2], which 
has an expected value n p^(k) . 

If equation (7.26) is substituted into equation (7.19), and c o'° is 


assumed, 
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C p‘ C l" p f (k) lp t ( k ) 1 “' I + • • • + C q [p f (k)J q [F f (k)] 


n! 




(7.27) 


+ ... +c n [ Pf (k)] n [ Pf (k)] . 


Now assuming that C = q C , that is, q failures cost q times as much as one 

q ^ 

failure. 


C p = C 1 ( n P f ( k ) tP f ( k ) 1 11-1 + • • o + q j tp f (k) ] q tp f (k) ] Q " q 

(7.28) 

+ . . . + n tp f (k) ] n [p f (k) ]} 

The term in the braces in equation (7.28) is recognized as the definition of the 
expected value of the binomial distribution. Therefore, 


c F = c F n p f(k) , (7.29) 

where = C ^ is the cost of flight failure. A physical interpretation is that 

n p (k) is the expected number of failures. P (/3) has been used to represent 
I t . 

J 

n P^(k) in Hie flow diagram of Figure 17. This emphasizes the dependence of 
the expected number of failures on the test option j and the safety index, /3. 

The expected cost of failure is then given by 

C P =C F (0) = C F P F ( 0 ) = C np £ (k) . (7.30) 

j j 

An identical development to equations (7. 19) through (7.29) can be constructed, 
using p f (p) = F R ( r 0 ) from equation (7.13) in place of p f (k), the number of 


J 



proof tests m in place of the number of load cycles n, and the cost of proof 


test failure C in place of the cost of flight failure C_ • When this is done, 
p 

equation (7.30) is generalized for the proof test option to yield 

S = (/?) = C F n p f (k) + C F m p f (p) . (7. 31) 

7.4 Cost Optimization 

The cost constituents from equations (7.16) , (7. 18) , and (7. 30) or 
(7.31) are now substituted into equation (7. 15): 

C(P)=C +C(t3)+C (p) . (7.32) 

J JJ j W r j 

The notation here emphasizes the dependence of costs on the test option j and 
the safety index 0. The cost optimization problem now reduces to the mini- 
mization of Cj(/3) with respect to the discrete variable j and the continuous 
variable 0. Consideration of the discrete variable j leads to separate equations 
for each test option: 

CAP) =C D +C w (p) +C F (?) (7.33) 

0 0 

C 3^ )=C D +C w ( ^ )+S F W) ‘ 

3 3 

A necessary condition for a relative minimum cost within a given test option is 
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provided that (/3 ) is continuous throughout the domain of /3, and dC.(/3) 1 
exists at the minimum point. This relative minimum is the absolute minimum 
provided that CL(a) and CL(b) are greater than CL(c) where a and b are 
the end points of the domain of /3 under consideration and c is the value of /3 
at the relative minimum given by equation (7.34) . Applying equation (7.34) to 
(7.33), 


d C 0 (/3) 

d/3 


0 


dC' 3 (/3) 


0 


(7.35) 


Let the solutions of equations (7. 35) be denoted by 13 = /3*. The minimum costs 
for each of the four test options are obtained by substituting these solutions into 
equation (7.33). 


= C D 0 + C Jo> + C f/o> 


“ °D 3 + C A } + C F 3 (I 3> 


(7.36) 


The minimum cost among all test options is selected by 

* ****.. . . 

C = min {C Q , Cg} . (7.37) 

Thus, the minimum cost test option and safety index combination is that one 

5jC 

corresponding to C. The minimization procedure just described was illustrated 
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by Figure 4 in Chapter m. Because of the complexity of the expressions for the 
expected cost of failure, the minimization procedure must be done numerically 
or graphically. A graphical method will be illustrated by the applications in 
Chapter VHI. 

Throughout Chapter VII there is an implicit assumption that the minimum 
cost for the particular structural assembly under consideration is not affected 
by the other assemblies in the structural system. This assumption is not be- 
lieved to be particularly restrictive for the typical aerospace system. The high 
reliabilities expected in aerospace systems tends to reduce the dependence of the 
probabilities of failure of the various assemblies on each other. Moses and 
Kinser [43] showed that an assumption of independence, when dependence actually 
exists, can cause significant errors in reliability prediction for structures with 


low reliabilities. 
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CHAPTER VHI 

APPLICATIONS 

8. 1 Discussion 

The purpose of this chapter is to demonstrate the application of the con- 
cepts developed in previous chapters to typical aerospace structural assemblies. 
These concepts culminate in the cost optimization presented in section 7.4. The 
applications given in this chapter are a direct application of the cost optimization 
procedure, where the costs for each test option, as given by equation (7.33) , 
are calculated for several values of /3 . Then the minimum cost decision is 
obtained by plotting the results to obtain the solutions of equations (7. 35) and 
(7.37) graphically. 

Some parametric results useful in applications have been obtained and 
included as Appendix C. These results provide graphical means of determining 
p^(k) needed in equation (7.31) Graphs are also presented in Appendix C for 
converting between the safety index and design safety factor. 

8.2 Input Data 

To conserve space and to provide for easy comparison of input and 
results, the applications examples are presented together in parallel instead of 
sequentially. Example structures are representative of structural assemblies 
in NASA’s Saturn V launch vehicle and Space Shuttle systems. The information 
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presented regarding these systems should not be taken as official NASA data but 
should be considered as typical of such systems. The Saturn V system is 
illustrated in Figure 19. The S-IVB stage aft skirt and the S-II forward skirt 
are the structural assemblies from this system selected as examples, A sketch 
of the Space Shuttle system is shown in Figure 20. The "External Tank (ET) 
intertank, Orbiter aft fuselage, Orbiter wings, and Solid Rocket Booster aft 
skirt are selected as examples from the Space Shuttle. 

Data required as input to the decision model for the example problems 
are shown in Table 9. The table headings indicate where each input is used in 
the equations of Chapter VH. Weight versus safety index is also needed in the 
decision model. This is most readily obtained in the form of weight versus 
safety factor, which is given for the example problems in Figures 21 through 26. 
To plot weight versus safety index would require a family of curves. Ore way of 
plotting would be to plot a curve for each test option, which would hold for only 
one particular coefficient of variation of load. The weight versus safety factor 
curve holds for any test option and any coefficient of variation of load. Since all 
of the example problem structures except the S-II stage are designed for a safety 
factor of 1.4, the reference value of weight mentioned in section 7.3. 2 should 
be the value from the figures corresponding to a 1.4 safety factor ( 1. 3 for the 

s-n). 


8.3 Results 

Results of the application of the decision model to the input data of 
section 8. 2 are shown in Figures 27 through 32. For each example problem, 
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STATION 



Figure 19. Saturn V System, 



Figure 20. Space Shuttle System 



Table 9 


Input Data for Example Problems 



Value of 

Cost of 

Cost of 

Cost of 

Cost of 

Cost of 

Coefficient 

Number of 

Number of 


Weight 

Flight 

Proof Test 

Test Option 

Test Option 

Test Option 

of Variation 

Flight Load 

Proof Test 

Example 

(dollars per 

Failure 

Failure 

Tl 

T 2 

t 3 

of Load 

Applications 


Problem 

pound) 

(dollars) 

(dollars) 

(dollars) 

(dollars) 

(dollars) 





c 

c 

c 

C 

0 

C 


n 

m 


W 

F 

F 

P 

°1 

D 2 

D 3 

r S 




Equation 

Equation 

Equation 

Equation 

Equation 

Equation 

Equation 

Equation 

Equation 


(7. 18) 

(7.30) 

(7.31) 

(7. 16) 

(7.16) 

(7.16) 

(C-4) 

(7.30) 

(7.31) 


1. S-IVB 
Aft Skirt 

11,500 

250 x 10 G 

0.72 x 10 6 

2.0 x 10 G 

3.28 x 10 6 

1. 0 X 10 G 

0. 12916 

15 

15 

2. S-II 

ForwaTd Skirt 

4,230 

250 x 10 6 

1. 23 x 10 6 

5.3 x 10 G 

8. 69 x 10 G 

2.65 x lo 6 

0. 12916 

15 

15 

3. ET 

Intertank 

13,706 

125 x 10 6 

0. 625 x 10 G 

2.0 x 10 6 

22.25 x 10 6 

1. 0 x 10 6 

0. 05787 

445 

445 

4. Orbiter 
Aft Fuselage 

18, 832 

250 x 10 G 

2. 0 x 10 6 

5.3 X 10 G 

3.3 X 10 6 

2.65 X 10 6 

0. 05787 

445 

5 

5. Orbiter 
Wings 

18, 832 

250 x 10 6 

2.0 x 10 6 

5.3 x 10 6 

6. 6 x 10 G 

2.65 x 10 6 

0.37 

890 

10 

6. SRB 
Aft Skirt 

1,624 

14. 8 x 10 6 

0.35 x 10 e 

2.0 x 10 G 

8.25 x 10 G 

1. 0 x 10 G 

0.37 

890 

50 
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the expected cost versus safety index and versus safety factor is plotted. Two 
sample calculations are shown in Appendix D, and the results are plotted as 
points A and B in Figure 27 and as points C and D in Figure 29. For clarity, 
the proof test option T 2 has been plotted separately, since there is a separate 
curve for each proof test level. In Figure 27(a) , the results for a simpler cost 
model in which P F (/3) was assumed equal to F N (n) (equation 7. 11) are plotted 

j 

as dotted lines. This model applies only if the probabilities of failure are very 
small. 

A summary of the final results is given in Table 10 for all example 
problems and all test options. The results were obtained by selecting minimum 
points on the curves in Figures 27 through 32. 

8.4 Trends Shown by Results 

The optimum decision for each of these example problems is the result 
of a complex interaction of several factors which contribute to the expected cost. 
Each of the inputs in Table 9 contributes to the expected cost. 

A higher value of weight in a structural assembly tends to produce lower 
optimum safety factors. A higher cost of flight failure tends to produce higher 
optimum safety factors. A high cost of proof test failure tends to discourage 
use of the Proof Test Option T 2 and to reduce the optimum level of the proof 
test load. The optimum proof test level represents the most cost effective 
balance between expected costs of proof test failure and flight failure. The 
number of flight load applications has a pronounced influence on the probability 
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of flight failure, resulting in a tendancy toward higher safety factors for larger 
numbers of flights. 

The Proof Test Option, T 2 , which has seldom been used in aerospace 
structures of this type, appears remarkably effective, even if the maximi m 
proof test level is restricted to 70 percent, as was done in Table 10. This 
effectiveness appears to arise because of the ability of this test option to pro- 
duce more reliable structures with smaller safety factors than the other test 
options. This trend can be observed by comparing Figure 36(a) with Figure 
37(a) in Appendix C, for example. The advantage of test option T 2 would be 
even more pronounced for one-of-a-kind structures, since only one item instead 
of several would have to be tested (m = l) , resulting in an even lower cost. 

The SRB aft ski rt optimum safety factors are generally lower than those 
of the other structures. This is very likely because of the lower cost of flight 
failure for this structure, resulting in a lower required reliability as compared 
with the other structures. 

An encouraging aspect of these results is the compatibility of the test 
option T x optimum factors with past experience. The S-IVB and S-H example 
problems were included to establish this compatibility. The design safety factor 
for these structures was 1.40, which compares closely with the 1.47 optimum 
value for Tj in Table 10. A lack of compatibility with previous experience would 
have made the validity of the model developed here questionable. 
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Table 10. Summary of Cost Optimum Decisions 


Cost 

Optimum 

Decisions 

S-IVB 
Aft Skirt 

S-II 

Forward 

Skirt 

ET 

Intertank 

Orbiter 

Aft 

Fuselage 

Orbiter 

Wing 

SRB 

Aft Skirt 

Overall 

Option 

Ti 

t 3 

T 2 

T 2 

T 2 

Ti 

P 

4. 12 

4. 15 

2.25 

2.32 

3.15 

4. 13 

rsj 

V 

1.47 

1.77 

1.37 

1.42 

1.43 

1.33 

Reliability 

0.995 

0.995 

0.955 

0.993 

0.951 

0.984 

Option T 0 

■T- 

P 

3.62 

3.70 

3. 80 

4.07 

4. 10 

3.75 

V 

2. 10 

2.25 

2.65 

3.25 

2.25 

1. 80 

Reliability 

0.988 

0.989 

0.870 

0.950 

0.900 

0.768 

Option Tj 
* 

P 

4. 18 

4.18 

4. 10 

4.65 

4.45 

4. 13 

V 

1.47 

1.47 

1.55 

1.87 

1.50 

1.33 

Reliability 

0.995 

0.996 

0.805 

0.953 

0.949 

0.984 

Option T 2 t 

* 

P 

2.6 

2.6 

2.25 

2.32 

3.15 

3.08 

C-J 

V 

1.35 

1.35 

1.37 

1.42 

1.43 

1.37 

Reliability 

0.998 

0.998 

0.955 

0.993 

0.951 

0.933 

Option T 3 

P 

4.10 

4.15 

4.20 

4.65 

4.45 

4.00 

r%» 

V 

1.70 

1.77 

1.95 

2.30 

1.80 

1.53 

Reliability 

0.994 

0.995 

0.850 

0.956 

0.940 

0.818 


tThe maximum proof test level considered feasible for these structures is 
70 percent. Higher levels could damage the structures by yielding. 
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Figure 22. S-II Forward Skirt Weight. 
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ORBITER AFT FUSELAGE WEIGHT, POUNDS 
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Figure 24. Orbiter Aft Fuselage W 
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ORBITER WINGS WEIGHT, POUNDS 
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SOLID ROCKET BOOSTER AFT SKIRT WEIGHT , POUNDS 
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c. Safety Factor versus Safety Index. 
Figure 27. (Concluded). 
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c. Safety Factor versus Safety Index. 
Figure 28. (Concluded). 
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c. Safety Factor versus Safety Index. 
Figure 29. (Concluded). 
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c. Safety Factor versus Safely Index. 
Figure 30. (Concluded). 
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c. Safety Factor versus Safety Index. 
Figure 31. (Concluded). 
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CHAPTER IX 

RESULTS, CONCLUSIONS, AND RECOMMENDATIONS 

9. 1 Results 

A review of the background material in structural reliability was pre- 
sented in Chapter I. This background was based on generally accepted principles 
that had evolved from the literature on the subject, which was reviewed in 
Chapter n. A problem was posed, and a method of solving the problem, based 
on statistical decision theory was presented in Chapter IE. Some concepts to be 
used in the problem solution were carefully explained in Chapter IV. The test 
option concept and a special safety factor definition were new ideas introduced 
in Chapter IV „ The test option formalizes certain structural test procedures in 
a manner suitable for use as one of the decision elements in statistical decision 
theory. The special safety factor definition will make the methods developed in 
this dissertation much easier for the typical user to employ than would alterna- 
tive safety factor definitions. 

The use of subjective expert opinion in decision methods was exploited in 
Chapter V. Questionnaires to obtain experts' opinions on structural reliability 
and probabilistic models for analyzing the opinions were developed. The validity 
of the questionnaire and modeling techniques was tested by using a trial ques- 
tionnaire concerning a problem for which observed data were available for 
comparison with the experts’ opinions. This comparison revealed that one 
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particular model, which utilized the experts 1 overall assessment of a particular 
strength distribution, agreed remarkably well with the observed data. This 
model and questioning technique was subsequently used to develop a strength 
distribution for a test option for which no observed data were available. 

In Chapter VI, Bayesian statistical methods were used for combining 
prior information from laboratory tests with new information from flight 
experience to develop a strength distribution for a particular test option. This 
was accomplished by fitting a two-parameter Weibull model to the laboratory 
data by the maximum likelihood method, then updating the scale parameter of 
this distribution with flight data, using Bayesian statistical methods. 

A decision model for selecting the test option and design safety index 
which results in minimum expected cost was developed in Chapter VII and 
applied to six typical aerospace structural assemblies in Chapter VQI. Results 
which appeared reasonable were obtained for each of the six example problems. 

9. 2 Conclusions 

1. The decision techniques developed in this research can readily and 
confidently be used for selecting design factors and test options for aerospace 
structures, if minimum expected cost is the desired objective. 

2. Expert opinions are a valuable source of quantitative information in 
structural problems, provided that adequate care and deliberation are used in 
acquiring the opinions and analyzing the results. 

3. Bayesian statistical techniques provide a viable method of combining 

prior information with new data in structural reliability problems. 



9. 3 Recommendations 


As is the case with most research, the completion of this endeavor 
provides several new problem areas in which further research could be initiated. 
Some of these will be discussed briefly. 

One group of such problems could come under the heading of an expan- 
sion of the decision space. The introduction of failure modes other than static 
strength failures would constitute such an expansion. For example, inclusion of 
fatigue failures would require that the decision space be expanded to include the 
selection of a fatigue test procedure and a fatigue safety measure, such as a 
design scatter factor. Another example would be the consideration of fracture 
mechanics where the decision would again involve selection of a test procedure 
and a safety measure appropriate to the fracture failure mode. Another con- 
sideration which would expand the decision space would be the selection of an 
optimal sample size (e.g. the optimum number of tests to run) which would 
minimize cost. 

A second group of related problems would involve a coupling of the 
decision for a given assembly with the decision for all other assemblies in the 
system. Although all the ramifications of such a coupling have not been fully 
explored, it is quite certain that it would lead to a very sophisticated optimiza- 
tion procedure, possibly far beyond any that has been developed. This could be 
an area of research in its own right. Oie cause of such a coupling would be an 
assumption that the reliability of one assembly depends upon the reliability of 
another. The following conditions tend to reduce such a dependence: (l) a small 
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variance in load compared with a variance in strength, (2; loads in the various 
assemblies arising from different sources, and (3) high reliability in all 
assemblies. Another cause of assembly coupling would be the application of a 
constraint on the total reliability of a system made up of several assemblies. 
Such a constraint could possibly be dictated by management or contractual 
requirement and would cause the expected cost to be higher than the attainable 
minimum<> 

Other features which would increase the quality of a decision would be 
the consideration of multiple load conditions and of the lack of symmetry of the 
cost with respect to an error in the decision. The first feature would simply 
require that all load conditions be included in calculating the probability of 
failure. A special case of this would be the omega condition proposed by Bouton 
and Trent [ 19] . The omega condition is one of infrequent occurrence, such as 
a load that might be caused by failure of a nonstructural system. Such a loading 
could be treated as a load distribution conditional upon the probability of failure 
of the nonstructural system. 

The unsymmetrical cost feature would be so devised that the decision- 
maker would not make the decision which absolutely minimizes cost but would 
bias his decision in the direction and by an amount that would minimize his risk 
when the asymmetry of cost with respect to his decision is considered. 

In the previous discussion of test options in Chapter IV, it was implied 
that a test option is deterministic in nature, and this is the intention in the 


present research. However, a more refined approach would not prescribe a 



178 


completely deterministic course of action but would recognize the probabilistic 
aspects of testing, such as noise in the test results. To be consistent with the 
Bayesian approach, it would not be sufficient to make inductive statistical 
inferences about the probabilities involved, but a means would need to be 
devised to cause such probabilities to be properly weighted as to their effect on 
the decision at hand. This could be a challenging and rewarding area. 
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APPENDIX A 
NOMENCLATURE 


Symbol 

A 

A, A.(/3) 
A | B 
A n B 
A U B 
a 
B 
C 

C, C .(/?) 


D 


C F’ C 1 

i 

c. 


c , c (p) 

w w 


Definition 

A general event. 

Action or decision space. 

Event A conditional on event B. 

Intersection of events A and B. 

Union of events A and B. 

A particular action or decision, 

A general event. 

Cause of a difference between actual and predicted strengths. 
Total expected cost. 

Optimum cost. 

Direct costs. 

Development costs. 

Cost of one failure. 

Expected cost of failure. 

Cost of i failures. 

Cost of weight. 


CDF 


Cumulative distribution function, 


?r> 
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NOMENCLATURE (Continued) 


c 

w 

D 

D i 

d i 

E 

E 

E(X) 

E{A> 

e 

F x (x) 

JxW 

f^(x) 

^(x) 

Sc (x) 

I. 

1 

i, j, k, 1, m, n 
k 

L 

y°> 


Unit cost of weight. 

Discrepancy between mathematical model and actual structure. 
A statistic measuring the difference between data and model. 

A particular value of . 

An entry in response to questionnaire. 

Mean value of repondents' (Questionnaire entries. 

A' ' 

Expected value of X. 

The event that the statement A is true. 

A constant, 2.71828 

Cumulative distribution function of the random variable X. 
Probability density function of the random variable X. 

Prior density function. 

Posterior density function. 

Bayesian density function. 

Event of failure in load increment i. 

Enumeration indices. 

Shape parameter of the Weibull distribution. 

Maximum likelihood estimate of k. 

Reliability; likelihood function. 

Probability that a structural assembly will survive n load 
applications. 


I 


Number of observed failures in a sample. 
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NOMENCLATURE (Continued) 


l , i’, l" 

m 

n 


O. 


PfA] 


p F . p F w 


p. 

1 


PDF 


P f ( k ) 

P f (k) 


i,r 


B, R.(/3) 


R 

r 


General, prior, and posterior values of a parameter of the 
gamma distribution* 

Number of structural assemblies to be proof tested. 

Number of observations in a sample; number of load cycles 
experienced by a structure; number of alternative actions. 

Number of structures expected to fail in load increment i from 
observed data. 

Probability that event A will occur. 

Expected number of failureso 
Probability of having exactly i failures. 

Probability density function. 

A constant; proof test cycle. 

th 

Probability of failure on the k application of load. 

th 

Probability of no failure on the k application of load. 

th 

Probability of failure on the i application of load and surviving 
all others. 

th th 

Probability of failure on the i and r applications of load and 
surviving all others. 

A constant. 

Resistance or strength of a structural assembly. 

A characteristic value of the resistance. 

Mean or expected value of the resistance. 

A particular value of R. 

Proof test load level. 
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S 

S 

q 

s 

SM 

SM 

T 

u 


v 

A 

V 

w, wO) 

x, Y, Z 
y» y’» y M 


a 


J3 

* 

P 

r 


Y R’ r S 


© 


e 

A 


NOMENCLATURE (Continued) 

Load applied to a structural assembly. 

A characteristic value of the load. 

Mean or expected value of the load. 

Safety margin. 

Mean or expected value of the safety margin. 

Test option. 

Utility function. 

Scale parameter of the Weibull distribution. 

Maximum likelihood estimate of v. 

Weight of a structural assembly. 

Particular probabilistic models of experts’ opinions. 

General, prior, and posterior values of a parameter of the gamma 
distribution. 

A constant; an allowable risk; a scaling factor; significance 
level. 

Safety index. 

Optimum safety index. 

The gamma function. 

Coefficients of variation of resistance and load, respectively. 
Vector of parameters of a probabilistic model; the state of nature. 
A particular value of 0 . 

A parameter of the Weibull distribution. 



NOMENCLATURE (Concluded) 


A particular value of A . 

Safety factor; factor for uncertainty. 

A safety factor in terms of characteristic values of resistance 
and load. 

Safety factor in terms of mean resistance and mean load. 

Safety factor in terms of analysts' predicted resistance and a 
characteristics value of load. 

Indicates the product of following terms. 

Indicates a summation of following terms. 

Standard deviations of resistance, load, and safety margin, 
respectively. 
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APPENDIX B 
QUESTIONNAIRES 

This appendix contains the questionnaires, as well as the introductory 
letters, used to elicit the opinions of experts in structural analysis and testing. 
The opinions obtained were used in calculating strength distributions for some of 
the test options used in this dissertation. 

Questionnaire A was used to test the method of acquiring opinions, the 
probabilistic models , and the ability of experts to provide the type of informa- 
tion needed. The results are analyzed in Chapter V. Questionnaire B was used 
for obtaining information to develop a strength distribution for test option T 3 , 
the model test option. The required distribution is calculated from the Ques- 
tionnaire B results in Chapter V. The Questionnaire C results yielded subjec- 
tive information which was combined with observed data to obtain a strength 
distribution for test option T ls the standard test option in Chapter VI. 

The questionnaires are included here exactly as they were sent to the 
experts. To conserve space, the mean responses to the questionnaires [ see 
equation ( 5. l) ] are entered in boldface type in the spaces provided for the 
experts' responses. 
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GEORGIA INSTITUTE OF TECHNOLOGY 
ATLANTA, GEORGIA 30332 


SCHOOL OF 

AEROSPACE ENGINEERING 


DANIEL GUGGENHEIM SCHOOL 
404-894-3000 OF AERONAUTICS 


Dear 


I am engaged in research on structural reliability with Dr. S. V. Hanagud 
at Georgia Tech in aerospace structural engineering. The end product of this 
research will be a methodology for selecting a combination of design safety 
factors (or equivalent parameters) and structural testing options which yields 
a minimum expected system cost. 

The particular decision theory to be used in this process permits subjec- 
tive information as well as objective information to be employed in reac hing a 
decision. One type of subjective information is expert opinion. In certain test 
cases a remarkable correlation between collective expert opinion and indepen- 
dent objective data has been observed. 

The enclosed questionnaire is being sent to a few experts, such as your- 
self, in the area of structural analysis and testing. It is the first of a series of 
two similar questionnaires which I hope you can find time to answer. 

There is no reason for me to believe that your opinions in this area or 
your employment affiliation should be sensitive information. Nevertheless, 
your reply will be treated as sensitive, and no names or employers will be 
disclosed in the publication of results. In fact, the replies will be sanitized 
(identification removed) upon receipt, and the publication will be a conglom- 
erate of replies in which no individual reply appears separately. It may be 
interesting for you to compare your own opinions with the collective opinions 
of other experts when the results are compiled. If you wish to receive a copy 
of the summary results, please check the box on the first page of the question- 
naire. 


As you may know, I am an employee of the National Aeronautics and Space 
Administration. However, I am presently assigned to full-time graduate study 
and am asking this as a personal favor in the interest of research, and not as 
an employee of NASA. To answer the questionnaire will require some delibera- 
tion and at least one hour of your time. However, we believe this effort will be 
amply rewarded by a greater insight into the factors affecting structural reli- 
ability. 



186 


The questionnaire has three parts, arranged in order of importance. 
If time does not permit you to answer the entire questionnaire, perhaps you 
could complete Part I, which is especially simple. If you intend to reply, 
please do so by July 15, 1973. A mail-back envelope is enclosed for your 
reply to 


Dr. S. Hanagud 

School of Aerospace Engineering 
Georgia Institute of Technology 
Atlanta, Georgia 30332 

If you are unable to complete the questionnaire for any reason, please 
mail it back anyway so we can keep track of our returns. Detach this letter 
for your records if you wish. 

Thank you very much for your time. 

Sincerely, 


JMT/jct 


Jerrell M. Thomas 
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Serial Number Mean Response 
Questionnaire A 


A STUDY OF FACTORS AFFECTING 
THE ACCURACY OF AEROSPACE STRUCTURAL ANALYSIS 


S. V. Hanagud and J. M. Thomas 
School of Aerospace Engineering 
Georgia Institute of Technology 
Atlanta , Georgia 30332 


( ) Please send summary of study results 
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INTRODUCTION 


EXPLANATION OF SERIES OF QUESTIONNAIRES 


The series of questionnaires consists of two separate question- 
naires, A and B. Questionnaire A is enclosed* Questionnaire B will 
be sent to respondents of A, after the results of A have been analyzed. 

The purpose of A is to determine the validity of the expert 
opinion approach in this particular application. Some objective* data 
are available for comparison with the collective expert opinion to be 
obtained from A. 

If there is good correlation between the objective data and expert 
opinion from A, B will be sent out. B will relate to a situation where 
objective data are not available. Thus, the collective expert opinion 
will be the only source of data available for the situation in B. 


EXPLANATION OF QUESTIONNAIRE A 


The questionnaire seeks to determine the amount and source of 
errors which can be expected in aerospace static structural analysis 
before the analyst has obtained qualification test results. This is 
done by using the analysts predicted failure load as a baseline 
value and attempting to determine the scatter about this baseline. 

The analyst T s prediction contains no safety factor . That is, the 100 % 
value is not limit load or limit load times the required safety factor, 
but is the load at which the analyst predicts the structure will fail. 

It is assumed that there is always some difference (sometimes very small) 
between the analyst f s prediction and the actual failure load. 

Innumerable questions would have to be answered to remove all 
ambiguity from the questionnaire. For example, one could legitimately 
ask: was the analysis done by the superior methods of my own company 

or by the obsolete methods of Company X? How much development testing 
or prior experience is associated with the design in question? What 
is the type of construction, etc? You are asked to answer these types 
of questions for yourself (and to yourself) by drawing on your own 
experience as to what constitutes a typical development program of a 
typical aerospace system . 

It is perfectly acceptable to consult with your co-workers or to 
review any data which you may have in hand in answering the questionnaire. 
On the other hand. It is also appropriate to give completely "off-the- 
cuff" responses. 


I 
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QUESTIONNAIRE A 


PART_ I, HOW ACCURATE ARE ANALYSTS T PREDICTIONS ? 

Suppose that during a typical development program of a typical 
major aerospace system, the point in time has been reached for struc- 
tural static qualification testing to begin . The test program is to be 
accomplished by testing one each of a number of large structural 
assemblies such as a complete wing, a thrust structure, a large fuse- 
lage section, an interstage structure, etc. For each assembly, the 
responsible stress analysts have given predictions of the ultimate fail- 
ure loads under static conditions (no fatigue involved) . We are 
interested in your judgement of how accurate we can expect these predic- 
tions to be. 

In the table below are ten test failure load increments, expressed 
as a percentage of analysts f predictions. Please indicate the approxi- 
mate percentage of test failures you would expect to fall in each incre- 
ment for static structural tests of this sort. For example, if you 
believe 20 $ of the assemblies tested will fail between 80$ and 90$ of 
failure load predicted by the analysts, you would enter 20$ in column 

(U. 


Table 1. Accuracy of Analysts T Predictions 


Test Failure Load Increment - Percent of Analysts 1 
Prediction _ 



'(i) 

(2) 

(3) 

(4) 

(5) 

(6) 

(7) 

(8) 

( 9 ) 

(10) 

I 


6o- 

70- 

80- 

90- 

100- 

110- 

120- 

130- 


1 

<60 

70 

80 

90 

100 

110 

120 

130 

140 

>140 

Your 

-Estimate of 
Percentage 

1 

0.9 

2.2 

1 

3.3 

; 

7.1 

1 

17.2 

29.3 

20.6 

11.3 

j 

j 4.5 

— 

1 

3.5 

of Failures 




j 

| 

; 

i ! 




i 

) 

i 

i i 


Check: Do your estimates of percent failures total 100$. 
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PART 11(A), WHAT CAUSES ANALYSTS T ERRORS ? 

We are interested in your opinion of what typically causes 
predicted failure loads to be different from actual test failure loads 
in tests of large structural assemblies. Listed below are several 
possible causes for these differences , with space for you to add any 
other causes which might account for the differences* 

In the table below, you are asked to indicate your judgement of 
the approximate percentage of all errors which are primarily caused 
by each of the causes listed (including any you have added). For 
example, if you feel that 5 out of every 100 prediction errors are due 
to "Scatter in material properties", please enter " 5 ” opposite item 4 
in the table. 


Table 2. Causes of Errors 


*Responses not shown. See letter introducing Approximate 

Questionnaire B. Percentage of 

Errors from this 

Primary Cause of Prediction Error Cause 

1. Analysts 1 mathematical model is a poor repre- 
sentation of the actual structure. * $ 

2. Analyst made a mathematical error. * $ 

3. Analyst overlooked (or failed to analyze) 

some critical area or failure mode. * $ 

4 . Scatter in material properties. » $ 

5. Variation (within tolerance) of dimensions. * $ 

6. Undetected manufacturing error. * % 

7. Test load condition did not represent flight 


condition used by analyst for prediction, (e.g., 
aerodynamic loads and boundary conditions are 

difficult to duplicate). » $ 

8. Other causes (Please list). 


TOTAL 100# 


Check: Do your percentages sum to 100$? 
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PART 11 (B). SIZE OP ERRORS FROM DIFTPRENT CAUSES (Continued) 


Table 5. Analyst Overlooked (or Failed to Analyze) 
Some Critical Area or Failure Mode 


Test Failure Load Increment - Percent of Analysts 1 
Prediction 


(1) I (2) ( 3 ) ( 4 ) ( 5 ) 

60- 70- 80- 90- 

<60 70 80 90 100 



Your 

Estimate of 
Percentage 
of Failures 


Test Failure Load Increment - Percent of Analysts’ 
Prediction . 

(l) 1 ( 2 ) (3) f (4) (V) T ~(6) (7) | (8) ; ( 9 ) f ( 10 ) 

60- 70- ! 80- 90- 100- 110 - 1 120- ! 130- 1 

<60 70 j 80 i 90 100 ! 110 120 I 130 I i 4 o j >i 4 o 

tii) 


0.3 0.5 1.2 5.8 25.4 35.0 17.5 8.9 j 4.4 1.0 


Table 7 * Variation (Within Tolerance) of Dimensions 

Test Failure Load Increment - Percent of Analysts ' 



Prediction 



(1) 

(2) 

( 3 ) 

( 4 ) 

( 5 ) 

(6) 

( 7 ) 



60- 

70 - 

80- 

90 - 

100- 

no- 


<60 

70 

80 

90 

100 

110 

120 

Your 

Estimate of 
Percentage 
of Failures 

0.2 

0.4 

2.3 

7.0 

32.4 

36.7 

i 

1 

12.3 






193 


PAM 1 11 (b). SIZE OF ER RORS FROM DIFFERENT CAUSES (Continued) 
Table 8 . Undetected Manufacturing Error 



Test Failure Load Increment - Percent 

of Analysts 1 



Prediction 









(i) 

(2) 

(3) 

(4) 

(5) 

(6) 

(7) 

(8) 

(9) 

(10) 



60- 

70- 

80- 

90- 

100- 

no- 

120- 

130- 



<60 

70 

8o 

90 

100 

no 

120 

130 

i4o 

>i4o 

Your 

Estimate of 
Percentage 
of Failures 

8.6 

! 

I 10.9 

13.6 

16.9 

24.3 

14.4 

5.5 

3.7 

1.5 

0.7 


Table 9 - Test Load Condition Did Not Represent Flight 
Condition Used by Analyst for Prediction 



Test Failure Load Increment - Percent 
Prediction 

of Analysts 

! 

i 

i 


(1) 

(2) 

(3) 

( 4 ) 

(5) 

( 6 ) 

(7) 

( 8 ) 

(9) 

(10) | 


<60 

60- 

70 

70- 

80 

«? 

- 

90- 

100 

100 - 

no 

no- 

120 

120- 

ISO 

H H 

1 

j 

>i 4 o I 

j 

Your 

Estimate of 
Percentage 
of Failures 

1.3 

3.0 

7.9 

16.1 

25.7 

20.8 

13.9 

7.0 

3.6 

0.7 


Table 10 . Other Causes 


Test Failure Load Increment - Percent of Analysts’ 
Prediction 



(i) 

(2) 

(3) 

(4) 

(5) 

(6) 

(7) 

(8) 

(9) 

(10) 



60- 

70- 

80- 

90- 

100- 

no- 

120- 

130- 



<60 

70 

80 

90 

100 

no 

120 

130 

i4o 

>i4o 

Your 

Estimate of 
Percentage 
of Failures 

3.1 

5.1 

8.9 

10.1 

24.2 

15.4 

11.5 

10.2 

6.3 

5.2 


Check: Do your entries in each table total 100 $? 
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PART III(A). DISCREPANCIES IMf MA THEMATICAL MO DEIS 

The purpose of Part III is to further quantify the errors in 
mathematical models (Cause Number l) • That is, the individual dis- 
crepancies which cause the analysts 1 mathematical model to be a poor 
representation of the actual structure will be examined. 

In the table below, please indicate in the Frequency of Occurrence 
column the percentage of occasions you believe the discrepancy in the 


left column will be the primary reason that the analysts’ mathematical 
model is in error. The Frequency of Occurrence column should total 100$, 

Table 11. Frequency of Discrepancies 
Discrepancy Between Analysts’ Mathematical Frequency of 

Model and Actual Structure 

Occurrence 

1. A stress distribution is assumed instead of cal- 
culated. Example: Linear stress distribution 

assumed over beam cross section near end of beam. 

12.4 j 

2. A linear analysis is used where a nonlinear analysis 
is closer to reality. Examples: Elastic analysis 

used in plastic area. Small deformation theory used 
where deformations are large. 

_ 18.2 % 

3. Empirical data i.s extrapolated too far. Example: 
Lightly stiffened shell buckling coefficients used 
for heavily stiffened shell. 

_13J_5 

4 . Incorrect boundary conditions are used. Example: 
Fixed edge used where component joins another 
elastic structure. 

17.3 i 

5. Finite element model is too coarse. Example : 
Rapid stress changes at discontinuity or 
cutout not predicted by model. 

16.6 i 

6. Geometric idealization is incorrect. Example: 
Sheet-stringer combination treated as 
isotropic plate. 

12.1 i 

7. Anisotropic or inhomogeneous materials treated 
as isotropic or homogeneous. Example: 

Composite material analyzed by methods applicable 
only to homogeneous, isotropic materials. 

6.1 i 


8. Other discrepancies (Please list). 


4.2 % 

Total: 100 $ 
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PART III(B) SIZE OF ERRORS FROM D IS CREPANCTES I R MATHEM AT ICAL MOD EIS 

In this part you are asked to indicate the amounts hy which you 
believe the discrepancies listed on the previous page can affect the 
difference between predicted and test strengths. The discrepancies 
are to he considered one at a time. You are asked to assume that a 
given discrepancy is known to he the reason for differences between 
predicted and test strengths. 

Please enter in the tables below your opinion of the percentages 
of assemblies which you believe would fail in each load increment due 
to the given discrepancy. The sum of entries in each table should 
total 100$. 

Table 12. A Stress Distribution Is Assumed Instead of Calculated 


Test Failure Load Increment - Percent of Analysts * 
Prediction 



(1) 

(2) ! 

i 

( 3 ) 

( 4 ) 

( 5 ) 

( 6 ) 

( 7 ) 

( 8 ) 

( 9 ) 

(10) 


i 

i 

6 o- | 

70 - I 

80- 

90 - 

100- 

110- 

120- 

130- 


1 

<6o 1 

I 

7 ° 

1 80 

! . . . .1 

90 

100 

110 

! 120 

130 

i 4 o 

; >i 4 o 

Your 

Estimate of 
Percentage 
of Failures 

1 

3.5 

I 3.3 ■ 

; ' ' i 

5.6 

; 

15.7 | 

23.3 

18.8 

1 

1 

14.9 

i i 

n 

7.9 j 

1 

| e, 

1 

2.0 


Table 13. A Linear Analysis Is Used Where a 

Nonlinear Analysis Is Closer to Reality 


Test Failure Load Increment - Percent of Analysts’ 
Prediction 



(i) 

(2) 

(3) 

( 4 ) 

(5) 

( 6 ) 

( 7 ) 

( 8 ) 

(9) 

(10) 



60- 

70- 

80- 

90- 

100 - 

110 - 

120 - 

130- 



<60 

70 

80 

90 

100 

110 

120 

130 

i 4 o 

>i 4 o 

Your | 







; 1 

1 1 

1 

i 



Estimate of 
Percentage | 

5.0 

4.6 

6.2 

15.5 

19.0 

17.3 

1 

| 10.7 

10.2 

8.3 

3.3 

_of Failures^] 








i 

_J 
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PART III(b). SIZE OF EKROBS FROM DISCR EP ANCIES IN MATHEM A TICAL MODEIS 
(Continued) 


Table 14. Empirical Data Is Extrapolated Too Far 



Test Failure Load Increment - Percent of Analysts 1 
Prediction 

(i) 

<6o 

Kill 

(3) 

70- 

8o 

(4) 

do- 

90 

(5) 

90- 

100 

(6) 

100- 

110 

(7) 

1IO- 

120 

(8) 

120- 

130 

(9) 

13Q- 

l4o 

( 10 ) 

>140 

Your 

Estimate of 
Percentage 
of Failures 

3.2 

5.6 


15.7 

24.1 

19.5 

10.3 

B 

B 

B 


Table 15 . Incorrect Boundary Conditions Are Used 



Test Failure Load Increment - Percent of Analysts* 
Prediction 

( 1 ) 

<60 

( 2 ) 

60 - 

70 


(4) 

80 - 

90 

( 5 ) 

90 - 

100 

(6) 

100- 

110 

(7) 

110- 

120 

(8) 

120- 

130 

(9) 

130- 

i4o 

( 10 ) 

>i4o 

Your 

Estimate of 
Percentage 
of Failures 

2.2 

3.9 

7.9 

14.5 

23.4 

17.8 

14.8 

7.9 

5.3 

2.2 


Table 1 6 . Finite Element Model Is Too Coarse 



Test Failure Load Increment - Percent of Analysts’ 
Prediction 

( 1 ) 

<60 

( 2 ) 

60 - 

70 

o) 

70 - 

80 

(4) 

80 - 

90 

( 5 ) 

90 - 

100 

ig 

Ea 

( 7 ) 

110 - 

120 


( 9 ) 

130 - 

i4o 

( 10 ) 

>140 

Your 

Estimate of 
Percentage 
of Failures 

2.5 

B 

B 

24.1 

24.5 

B 

9.8 

B 

B 

1.0 




































PAKT III(B). SIZE OF EKROHS F ROM PIS CEEP ANCIES UT MATHEMATICAL MODE IS 
(Continued) 

Table 17. Geometric Idealization Is Incorrect 


Test Failure Increment - Percent of Analysts 1 
Prediction 


Your 

Estimate of 
Percentage 
of Failures 


3.9 4.0 


( 7 ) 

(8) 

( 9 ) 

(10) 

no- 

120- 

130- 


120 

130 

140 

>i 4 o 

11.7 

5.6 

4.4 

1.6 


Table 18. Anisotropic or Inhomogeneous Materials 
Treated As Isotropic or Homogeneous 


Test Failure Load Increment - Percent of Analysts 
Predict ion 


(i) 

<60 I 70 


Estimate of 

Percentage 8.3 7.0 10.2 16.5 22.3 16.1 10.2 

of Failures 


( 9 ) 

iso- 

140 

(10) 

>i 4 o 

3.2 

1.3 


Table 19 . Other Discrepancies 


Test Failure Load Increment - Percent of Analysts 
Predict ion __ _ _ _ ^ 

( 2 ) ( 3 ) ( 4 ) ( 5 ) I (6) ( 7 ) I (8) I ( 9 ) (10) 

60- 70- 8o- 90- 100- no- 120- 130- 

70 80 90 100 no 120 130 i 4 o >i 4 o 


Your 

Estimate of 

Percentage 7.2 3.3 7.8 15.6 18.9 22.2 12.2 


3.9 1.7 


of Failures J L l ... J 1 

Check: Do your entries in each table total 100$ 
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PART IV 
Comments : 


Name: 

Employer : 


End of Questionnaire A 

Please enclose in envelope provided and mail to: 
Dr, S. Hanagud 

School of Aerospace Engineering 
Georgia Institute of Technology 
Atlanta, Georgia 30332 
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GEORGIA INSTITUTE OF TECHNOLOGY 


ATLANTA, GEORGIA 30332 


SCHOOL OF 

AEROSPACE ENGINEERING 


DANIEL GUGGENHEIM SCHOOL 
OF AERONAUTICS 


Dear 


Your response to our first questionnaire on factors affecting the accuracy 
of aerospace structural analysis was certainly appreciated. Some meaningful 
preliminary results have already been obtained from Questionnaire A, and a 
summary of those results is enclosed. Analysis of Questionnaire A is continuing 
along the line of searching for better data reduction techniques. 

As mentioned in our first letter an enclosed second questionnaire has been 
prepared, which is similar to the first questionnaire, but deals with the increased 
analytical accuracy obtained through an expanded component and model develop- 
ment test program. 

It has been determined that Part n(A) in Questionnaire A was probably 
poorly constructed (see enclosed Preliminary Results from Questionnaire A). 
Therefore, a revision of Part 11(A) is included in this mailing. Please complete 
the revised Table 2 and return it with Questionnaire B. 

Your reply to Questionnaire B is especially important to us, since it is 
being sent only to respondents of Questionnaire A. 

If you intend to reply, please do so by September 17, 1973. Thank you 
again for spending part of your valuable time in helping with this reaearch. 

Sincerely, 


JMT/jt 

Enclosure 


Jerrell M. Thomas 



Mean Response 


Serial Number _ 
Questionnaire B 


A STUDY OF THE EFFECTS OF 
MODEL AND COMPONENT TESTING IN INCREASING 
THE ACCURACY OF AEROSPACE STRUCTURAL ANALYSIS 


S. VL Hanagud and J. M. Thomas 
School of Aerospace Engineering 
Georgia Institute of Technology 
A'tlanta, Georgia 30332 


( ) Please send summary of study results 
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INTRODUCTION 


This questionnaire seeks to determine the amount and source of er- 
rors in aerospace static structural analysis, assuming that the analyst 
has available to him the results of an extensive component and model de- 
velopment test program. This is done by using the analyst’s predicted 
value as a baseline value and attempting to determine the scatter about 
this baseline. The analyst’s prediction contains no safety factor. That 
is, the 100$ value is the load at which the analyst predicts the struc- 
ture will fail. It is assumed that there is always some difference (some- 
times very small) between the analyst’s prediction and the actual failure 
load. 


In Questionnaire A you were asked to assume that the analyst’s pre- 
dictions were based on a typical development program of a typical aero- 
space system. The point in time assumed was before any static qualifica- 
tion testing had been accomplished. The only change in these assumptions 
for Questionnaire B is that much more than a typical development program 
is assumed to have been accomplished in the area of component and model 
testing. The expanded component and model test program to be assumed is 
described qualitatively in the following paragraph. 

A component is defined as a reasonably small structural subassem- 
bly such as a ring segment, a thrust post (longeron), or a major fitting. 
A model is a scaled (in the engineering sense) replica of a large struc- 
tural assembly. Development testing is accomplished on such components 
and models through the use of an iterative process. The iterative process 
involves basing the test conditions on expected service conditions, pre- 
diction of test results by the best available analysis methods, direct 
and detailed comparison of test results with analytical predictions, and 
repetition of design , analysis , and testing until analysis and test re- 
sults agree . Design of every subassembly of the flight article is then 
based on these components and models , and the flight article is analyzed 
by the samg techniques which agreed with the model and component test re - 
sults . 


AH parts of Questionnaire B pertain to the accuracy in analysis 
of the flight article after such an extensive development program but 
before any full scale structural qualification testing. 

Even if you have no data or observations in such a situation, we 
are interested in your opinion about the expected accuracy. 


I 
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QUESTIOEMIRE B • 


PART I , HOW ACCURATE ARE AMLYSTSJ PREDICTIO NS? 

Suppose that during development of a typical aerospace system, a 
number of large structural assemblies have been de veloped through the 
model and component test_ procedure described in the intro duction. For 
each assembly, the responsible stress analysts have given predictions of 
the ultimate failure loads under static conditions (no fatigue involved). 
We are interested in your judgement of how accurate we can expect these 
predictions to be. 

In the table below are ten test failure load increments, expressed 
as a percentage of analysts' predictions. Please indicate the approximate 
percentage of test failures you would expect to fall In each increment if 
each assembly developed by the above procedure is subjected to a static 
test. For example, if you believe 20$ of the assemblies tested will fail 
between 80$ and 90 $ of failure load predicted by the analysts, you would 
enter 20$ in column ( 4 ). 


Table 1. Accuracy of Analysts' Predictions 
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PART 11(A). WHAT CAUSES DIFFERENCES BETWEEN PREDICTED AND ACTUAL FAILURE 
LOADS? " ' * — 


Assume that differences of various magnitudes have been observed 
between analysts T predicted failure load and actual test failure load in 
each of 100 structural assemblies consisting of components developed 
according to the expanded component and model test program described in 
the introduction. In the table below is a list of possible causes of 
the observed differences. 

Assume that in the sample of 100 structural assemblies you will 
always find one of the causes present , and that occasionally you may find 
more than one cause present. For example, scatter in material properties 
and variation of dimensions could be present in addition to an analyst 1 s 
poor mathematical model. 

In what percentage of the tests do you believe that each of the 
causes was a contributor to the observed difference, regardless of the 
magnitude of tne difference? Your entries in Table 2 can also be inter- 
preted to represent how often or how frequently you think the given cause 
contributes to differences in predicted and actual strengths. Because the 
sample is concerned with all structures that differed from the analyst’s 
prediction, without regard for the magnitude of the differences, any one 
or more of these causes (e.g. scatter in material properties or variation 
of dimensions* or any one of the other 8 causes in the list) may be re- 
sponsible (Hypothetically) for only small magnitudes of differences, but 
could be present in large numbers in the sample of 100. Causes 4 and 5 
are to be interpreted as normal or natural occurrences and the remaining 
causes are intended to represent errors or anomalies. Since one or more 
causes are assumed to always be present, your entries should total 100$> 
or more . — — 


Table 2. Causes of Differences 
Cause of Difference 


Frequency of 
Occurrence 


1# Analysts’ mathematical model is a poor representation 

of the actual structure. 21.33 % 

2. Analyst made a mathematical error. 6.72 j o 

3. Analyst overlooked (or failed to analyze) some 

critical area or failure mode. 24.44 jo 


*These causes are given as examples only and should not be permitted 
to influence your response. 
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Table 2. Causes of Differences (continued) 
Cause of Difference 


Frequency of 
Occurrence 


4. Scatter in material properties. 

5. Variation (within tolerance) of dimensions. 

6. Undetected manufacturing error. 

7. Test load condition did not represent flight 
condition used by analyst for prediction, (e.g., 
aerodynamic loads and boundary conditions are 
difficult to duplicate). 


18.00 $ 
15.78 j o 
14.94 $ 


17 . 28 $ 


8. Other causes (Please list). 


3 . 72 $ 


Total: 


122.21 % 
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PARC 11 (B). SIZE OF ERRORS FROM DIFFERENT CAUSES 

On the previous page you gave an indication of what you believe 
are the causes for differences in predicted and test strengths of 
structural assemblies. In the tables below you are asked to indicate 
the amounts by which you believe these causes can affect the difference. 
The causes are to be considered one at a time. You are asked to assume 
that a given cause has been determined to be the reason for differences 
between test and predicted strengths in a number of assemblies. 

Please enter in the tables below your opinion of the percentages 
of assemblies which you believe would fail in each load increment due 
to the given cause. The sum of entries in each table should total 100 $. 


Table 3 - Analysts’ Mathematical Model Is A Poor 
Representation of the Actual Structure 


Test Failure Load Increment - Percent of Analysts’ 
Prediction 



(1) 

<6o 

(2) 

6o- 

70 

( 3 ) " 

70 - 

80 

( 4 ) 

80- 

90 

( 5 ) 

90- 

100 

(6) 

100- 

110 

( 7 ) 

110- 

120 

(8) 

120- 

130 

( 9 ) 

130 

i4o 

(10) 

>i4o 

Your 

Estimate of 
Percentage 
of Failures 

■ 

1.89 

__ . 

2.22 



8.17 

15.11 

22.94 

23.33 

15.28 

6.11 

3.50 

1.44 

1 


Table 4 . Analyst Made a Mathematical Error 


Test Failure Load Increment - Percent of Analysts’ 
Prediction 



(1) 

(2) 

(3) 

(4) 

(5) “ 

(6) 

(7) 

(8) 

(9) 

(10) 



60- 

70- 

80- 

90- 

100- 

no- 

120- 

130- 



<60 

70 

80 

90 

100 

110 

120 

130 

i4o 

>i4o 

Your 

Estimate of 
Percentage 
of Failures 

1.69 

3.88 

8.56 

18.44 

23.88 

21.81 

11.88 

5.81 

2.81 

1.25 
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PART 11 (B) ♦ SIZE OF ERRORS FROM DIFFERENT CAUSES (Continued) 


Table 5. Analyst Overlooked (or Failed to Analyze) 
Some Critical Area or Failure Mode 



Test Failure Load Increment - Percent of Analysts' 
Prediction 

( 1 ) 

<60 

(2) 

Go- 

10 

(3) 

70- 

80 

w 

80- 

90 

(5) 

90- 

100 

m 

(7) 

110- 

120 

(B) 

120- 

130 


(10) 

>i4o 

Your 

Estimate of 
Percentage 
of Failures 

3.83 

8.00 

13.28 

23.89 

27.22 

12.78 

7.22 

2.72 

1.00 

B 


Table 6 . Scatter in Material Properties 



Test Failure Load Increment - Percent of Analysts’ 
Prediction 

( 1 ) 

<60 

( 2 ) 

60- 

70 

(3) 

10- 

80 

( 4 ) 

80- 

90 

(5) 

90- 

100 

(6) 

100- 

110 

(7) 

no- 

120 

(8) 

120 - 

130 

(9) 

130- 

l4o 

(10) 

>i4o 

Your 

Estimate of 
Percentage 
of Failures 

B 

B 

1.81 

9.81 

28.25 

34.63 

19.91 

4.81 

g 



Table 7 - Variation (within Tolerance) of Dimensions 



Test Failure Load Increment - Percent of Analysts' 
Prediction 

( 1 ) 

<60 

(2) 

60- 

70 

(3) 

70- 

80 

( 4 ) 

80- 

90 

(5) 

90- 

100 

(6) 

100 - 

110 

( 7 ) 

110 - 

120 

(8) 

120 - 

130 

ON 

s -- " H H 

(10) 

>i4o 

Your * 

Estimate of 
Percentage 
of Failures 

B 

B 

2.25 

B 

31.56 

33.75 

15.81 


1.63 

B 
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PART II(B). SIZE OF ERRO RS FROM DIFFERENT CAUSES (Continued) 
Table 8. Undetected Manufacturing Error 



Test Failure Load Increment - Percent 
Prediction 

of Analysts* 



(1) 

<6o 

(2) 

60- 

70 

(3) 

70- 

8o 

(4) 

80- 

90 

(5) 

90- 

100 

(6) 

100- 

110 

(7) 

110- 

120 

(8) 

120- 

130 

(9) 

130- 

l4o 

(10) 

>i4o 

Your 

Estimate of 











Percentage 
of Failures 

4.00 

7.11 

11.78 

23.83 

28.33 

16.39 

6.44 

1.28 

0.67 

0.17 


Table 9* Test Load Condition Did Not Represent Flight 
Condition Used by Analyst for Prediction 



Test Failure Load Increment - Percent of Analysts* 
Prediction 

(1) 

<60 

(2) 

GO- 

10 

(3) 

70- 

80 

(4) 

80 - 

90 

(5) 

90- 
100 • 

(6) 

100- 

110 

(7) 

110- 

120 

(8) 

120- 

130 

(9) 

ISO- 

140 

(10) 

>l4o 

Your 

Estimate of 
Percentage 
of Failures 

0.13 

1.56 

8.44 

16.38 

28.88 

22.19 

13.94 

5.81 

2.19 

0.50 


Table 10. Other Causes 



Test Failure Load Increment - Percent of Analysts ' 
Prediction 

(1) 

<6o 

(2) 

60 - 

70 

(3) 

70- 

80 

(4) 

80 - 

90 



(7) 

110- 

120 

(8) 

120- 

130 

(9) 

130 - 

i4o 

( 10 ) 

>140 

Your 

Estimate of 
Percentage 
of Failures 

2.50 

■ 

B 

16.00 

B 

15.50 

9.00 

6.50 

3.00 

1.50 


Check: Do your entries in each table total 100$? 
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PART III(A). DISCREPANCIES IN MATHEMATICAL MODE IS 

The purpose of Part III is to further quantify the errors in 
mathematical models (Cause Number l) . That is, the individual dis- 
crepancies which cause the analysts* mathematical model to he a poor 
^representation of the actual structure will he examined. 

In the table helow, please indicate in the Frequency of Occurrence 
column the percentage of occasions you believe the discrepancy in the 


left column will be the primary reason that the analysts 1 mathematical 
model is in error. The Frequency of Occurrence column should total 100$ 

Table 11. Frequency of Discrepancies 
Discrepancy Between Analysts* Mathematical Frequency of 

Model and Actual Structure 

Occurrence 

1. A stress distribution is assumed instead of cal- 
culated. Example: Linear stress distribution 

assumed over beam cross section near end of beam. 

11.72 # 

2. A linear analysis is used where a nonlinear analysis 
is closer to reality. Examples: Elastic analysis 

used in plastic area. Small deformation theory used 
where deformations are large. 

17.65 

3. Empirical data is extrapolated too far. Example: 
Lightly stiffened shell buckling coefficients used 
for heavily stiffened shell. 

12.94 i 

4. Incorrect boundary conditions are used. Example: 
Fixed edge used where component joins another 
elastic structure. 

18 . 94 - $ 

5. Finite element model is too coarse. Example: 
Rapid stress changes at discontinuity or 
cutout not prelicted by model. 

20.00 % 

6. Geometric idealization is incorrect. Example: 
Sheet-stringer combination treated as 
isotropic plate . 

13.59 oJ g 

7. Anisotropic or inhomogeneous materials treated 
as isotropic or homogeneous. Example: 

Composite material analysed by methods applicable 
only to homogeneous, isotropic materials. 

3.76 £ 


8. Other discrepancies (Please list). 


2.00 j 

Total: 100'/o 
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PACTIII(b). SIZE OF ERRORS FROM DEmEgA gCgS IN MATHEMATICAL MODE 13 

In this part yon are asked to indicate the amounts by which you 
believe the discrepancies listed on the previous page can affect the 
difference between predicted and test strengths. The discrepancies 
are to be considered one at a time. You are asked to assume that a 
given discrepancy is known to be the reason for differences between 
predicted and test strengths. 

Please enter in the tables below your opinion of the percentages 
of assemblies which you believe would fail in each load increment due 
to the given discrepancy. The sum of entries in each table should 
total 100$. 


Table 12. A Stress Distribution Is Assumed Instead of Calculated 


Test Failure Toad Increment - Percent of Analysts 1 
Prediction 



(1) 

(2) 

(3) 

(4) 

(5) 

(6) 

(7) 

(8) 

(9) 

(10) 



60 - 

70- 

80 - 

90- 

100- 

no- 

120- 

130 - 



<60 

70 

80 

90 

100 

no 

120 

130 

li(0 

>i4o 

Your 

Estimate of 
Percentage 
of Failures 

0.33 

2.67 

10.67 

15.73 

25.33 

24.13 

12.40 

5.33 

3.13 

0.27 


Table 13. A Linear Analysis Is Used Where a 

Nonlinear Analysis Is Closer to Reality 



Test Failure Load Increment - Percent of Analysts* 
Prediction 

(i) 

<6o 

(2) 

60 - 

70 

(3) 

70- 

80 

(4) 

80- 

90 

(5) 

90- 

100 

i 

. * O Q 

(7) 

no- 

120 

(8) 

120- 

130 

(9) 

130 - 

ikO 

( 10 ) 

>llK) 

Your 

Estimate of 
Percentage 
of Failures 

1.69 

2.13 

8.63 

18.69 

23.75 

22.81 

12.88 

5.75 

2.69 

1.00 
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PART III(B) . SIZE 0F_ ERRORS F ROM D ISCREPAN CIES IN _MATHEMAT ICAL MODEIS 
(Cont inued ) 


Table 14. Empirical Data Is Extrapolated Too Far 



Test Failure Load Increment - Percent 
Prediction 

of Analysts 



a) 

<60 

(2) 

60- 

70 

(3) 

70- 

80 

"(4) 

80- 

90 

(5) 

90- 

100 

(6) 

100- 

110 

(7) 

110- 

120 

(8) 

120- 

130 

(9) 

130- 

i4o 

(10) 

>l4o 

Your 

Estimate of 










1 

Percentage 
of Failures 

0.47 

4.59 

13.06 

22.24 

25.12 

16.53 

10.88 

4.82 

2.12 

0.18 


Table 15 . Incorrect Boundary Conditions Are Used 



Test Failure Load Increment - Percent 

of Analysts 1 



Prediction 









(1) 

(2) 

(3) 

O) 

(5) 

(6) 

(7) 

(8) 

(9) 

(10) 



60- 

70- 

1 

O 

CO 

90- 

100- 

no- 

120- 

130- 



<60 

70 

80 

90 

100 

110 

120 

130 

140 

>i4o 

Your 











Estimate of 
Percentage 
of Failures 

0.53 

3.06 

5.82 

16.12 

32.71 

19.53 

10.18 

7.82 

3.53 

0.71 


Table 16. Finite Element Model Is Too Coarse 



Test Failure Load I 


Prediction 



( 1 ) 

(2) 

(3) 

(4) 



60 - 

70- 

80- 


<60 

70 

80 

90 

Your 

Estimate of 
Percentage 

0.71 

4.59 

13.00 

22.76 

of Failures 






(5) 

(6) 

(7) 

90- 

100- 

no' 

100 

no 

120 

30.76 

15.59 

7.5S 





( 8 ) 

120 - 

130 


(9) 

iso- 

140 


1.18 


( 10 ) 

>i4o 

0.12 1 


3.76 
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PART 111(B) * _SEE O F ERR ORS FROM DIS^PMCIES_m MA TFIEMAT I GAL MODELS 
XContinued) 

Table 17* Geometric Idealization Is Incorrect 



Test Failure Increment - Percent of Analysts 1 



Prediction 









(1) 

(2) 

(3) 

(4) 

(5) 

(6) 

(7) 

(8) 

(9) 

( 10 ) 



60- 

70- 

80- 

90- 

100- 

no- 

120- 

130- 



<60 

70 

80 

90 

100 

110 

120 

130 

140 

>.l4o 

Your 

Estimate of 











Percentage 
of Failures 

0.41 

2.59 

11.41 

19.82 

29.71 

19.59 

10.41 

4.47 

1.47 

0.12 


Table 18. Anisotropic or Inhomogeneous Materials 
Treated As Isotropic or Homogeneous 



Test Failure Load Increment - Percent of Analysts 1 
Prediction 

( 1 ) 

<60 

( 2 ) 

60 - 

70 

(3) 

70 - 

80 

(4) 

80 - 

90 

( 5 ) 

90 - 

100 

(6) 

100- 

110 

( 7 ) 

110 - 

120 

’ (8) 

120- 

130 

( 9 ) 

130 - 

140 

( 10 ) 

>i4o 

Your 

Estimate of 
Percentage 
of Failures 

2.73 

5.67 

12.00 

17.27 

25.33 

17.33 

10.93 

5.00 

3.33 

0.40 


Table 19- Other Discrepancies 



Test Failure Load Increment - Percent 

of Analysts 1 



Prediction 









(1) 

(2) 

(3) 

(4) 

(5) 

(6) 

(7) 

(8) 

(9) 

(10) 



60- 

70- 

80- 

90- 

100- 

110- 

120- 

130- 



<60 

70 

80 

90 

100 

110 

120 

130 

i4o 

>i4o 

Your 

Estimate of 
Percentage 
of Failures 

1.67 

3.83 

7.50 

22.00 

21.67 

26.33 

9.17 

4.17 

2.00 

f 

1.67 


Check: Do your entries in each table total 100#? 
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PART IV, COST OF DEVTIK)BMIT TEST PROGRAM 

We are interested in the relative cost of the model and component 
development test program considered in this, .questionnaire. All costs 
related to the testing are of interest except construction of facilities. 
Some pertinent costs are test hardware* instrumentation* fixtures* and 
test operations. 

What would you expect such a model and component test program to 
cost* expressed as a percentage of a typical static structural qualifi- 
cation test program? 


50 io 


PART V. COMMENTS 


End of Questionnaire B 

Please enclose in envelope provided and mail to: 
Dr . S . Hanagud 

School of Aerospace Engineering 
Georgia Institute of Technology 
Atlanta* Georgia 30332 


Name: 


Employer: 
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Revision to Part II (A) of Questionnaire A 


Please complete and return 'with Questionnaire B 
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PART 11(A). -WHAT CAUSES DIFFERENCES BETWEEN PREDICTED AND ACTUAL FAILURE 
LOADS? 


Assume that differences of various magnitudes have been observed 
between analyst’s predicted failure load and actual test failure load in 
each of 100 structural assemblies developed according to what you would 
consider typical aerospace structural development program. In the table 
below is a list of possible causes of the observed differences. 

Assume that in the sample of 100 structural assemblies you will 
always find one of the causes present, and that occasionally you may find 
more than one cause present. For example, scatter in material properties 
and variation of dimensions could be present in addition to an analyst's 
poor mathematical model. 

In what percentage of the tests do you believe that each of the 
causes was a contributor to the observed difference, regardless of the 
magnitude of the difference? Your entries in Table 2 can also be inter- 
preted to represent how often or how frequently you think the given cause 
contributes to differences in predicted and actual strengths. Because the 
sample is concerned with all structures that differed from the analyst’s 
prediction, without regard for the magnitude of the differences, any one 
or more of these causes (e.g. scatter in material properties or variation 
of dimensions* or any one of the other 8 causes in the list) may be re- 
sponsible (Hypothetically) for only small magnitudes of differences, but 
could be present in large numbers in the sample of 100. Causes k and 5 
are to be interpreted as normal or natural occurrences and the remaining 
causes are intended to represent errors or anomalies. Since one or more 
causes are assumed to always be present, your entries should total 100 jo 
or more. 


Table 2 . Causes of Differences 
Cause of Difference 


Frequency of 
Occurrence 


1. Analysts’ mathematical model is a poor representation 

of the actual structure. 25.00 

2. Analyst made a mathematical error. 8.38 ^ 

3. Analyst overlooked (or failed to analyze) some 

critical area or failure mode. 24.69 ^ 


* These causes are given as examples only and should not be permitted 
to influence your response. 
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Table 2. Causes of Differences (continued) 


Cause of Difference 


Frequency of 
Occurrence 


4. Scatter in material properties, 

5. Variation ('within tolerance) of dimension. 

6 . Undetected manufacturing error . 

7. Test load condition did not represent flight 
condition used by analyst for prediction. (e,g., 
aerodynamic loads and boundary conditions are 
difficult to duplicate) . 

8. Other causes (Please list). 


19.13 j o 
16.00 aj Q 

12.81 j o 


19.63 € 


4.69 ft 


Total: 


130.33 % 



Mean Response 


Serial Number __ 
Questionnaire C 


AEROSPACE STRUCTURES 

STRENGTH IMPROVEMENT BY DESIGN MODIFICATIONS 

AND 

LOADS EXPERIENCED BY SATURN V FLIGHT STRUCTURES 


J. M. THOMAS 

School of Aerospace Engineering 
Georgia Institute of Technology 
Atlanta, Georgia 30332 
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QUESTIONNAIRE C 


Questionnaire C consists of two separate areas of interest: improvement 
in strength of structural assemblies gained by design modifications made 
in the structure after test failures and loads typically experienced by 
structures in flight. These areas will be considered separately in 
Farts I and II. 


Par t I. I MPROVEMENT IN STRENGTH BY DESIGN MODIFICAT IONS 

Suppose that a large number of large aerospace structural assemblies, 
designed and analyzed by typical methods, have been static tested. We 
are interested in the portion of these structures that failed at less 
than the analysts* predicted failure load, which is designated as 100% 
design ultimate load (DUL). Suppose that of those structures failing, 

8% failed between 70% and 80%, 35% failed between 80% and 90% , and 
57% failed between 90% and 100% of the analysts* predicted failure load. 
This is shown in line 1 of Table 1, below. 

Now assume that failure analyses of these structures are conducted, 
design changes are made and incorporated in the test assemblies, and 
the assemblies are retested and all sustain at least 100% load. 


Suppose that a new group of these assemblies is now built, and the 
same design changes incorporated in the test assemblies are incorporated 
in the new build. If this new build of assemblies should now be tested, 
what percentage would you expect to fail in each load increment given 
in Table 1? Enter your estimates in line 2. Your estimates should 
total 100%. 


Table 1. Strength Improvement 


Line 

Description 

f | 

Test Failure Load Increment - Percent 

of Analysts* Prediction (DUL) 1 

. . ___ I 

a ) 

70 - 80 

(2) ' 
80-90 

(3) 

90-100 

(4) 
> 100 

1 

Percent of Structures 
Failing First Test in 
Each Increment 

8 

35 

57 

- 

2 

Your Estimate of Per- 
cent of Redesigned 
Structures Failing in 
Each Increment 

0.11 

1.22 

6.78 

91.89 
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Part II. LOADS EXPERI ENCED BY SATURN V FLIGHT STRUCTURES 

We are interested in loads experienced by large structural assemblies 
of the Saturn V system in actual operation. Many structural assemblies 
have more than one critical design condition. In all that follows, 
consider the maximum load experienced in each mission for each design 
condition as one "loading" of the structure. Of all loadings experienced 
by all assemblies of the Saturn V launch vehicle in all missions to date, 
what percentage of the loadings do you believe fell in each load increment 
shown in Table 2, below? The Table is in terms of design ultimate load. 
Your entries should total 100%, 


Table 2. Loads on Saturn V Structures in Operation 


-- 

Flight Load Increment 

- Percent of Design Ultimate 1 


Load 








a ) 

(2) 

(3) 

(4) 

(5) 

(6) 

(7) 



30- 

40- 

50- 

55- 

60- 

65- 


<30 

40 

50 

55 

60 

65 

71* 

Your Estimate of 
Percent of Struc- 








tures Experiencing 
Loading in Each 
Increment 

15.00 

7.22 

9.22 

12.44 

20.22 

' 13.78 

| 

22.11 


* 71% of design ultimate load is approximately limit load. If you are 

aware of any Saturn structures experiencing greater than limit load, 
please discuss briefly in the space below. 



APPENDIX C 


PARAMETRIC ANALYSIS 

This appendix gives the results of a parametric analysis which was done 
to establish the sensitivity of the probability of failure of a structural assembly 
to certain variables: test option T^, safety index /3, safety factor v, and 
coefficient of variation of load y . The figures presented here are very useful 

O 

for determining the probability of failure for a single application of load, p^(k) , 
as given by equation (7.6), Chapter VII. The p^(k) determined from these 
figures can then be entered into the cost model through equation (7. 30) , Chapter 
VII, or used for any other purpose for which p^(k) is required. 

The figures, in conjunction with the nomenclature in Appendix A, are 
essentially self-contained, and no detailed explanation of each figure is required. 

An outline of the method used to calculate a typical point for plotting on 
the p^(k) versus (3 curves follows. From the definition of the safety index, 

a = R ~ -- , (c-i) 

where cr^ = y_ R and cr = y S . Then 
K K o o 
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Note that for positive values of (3, R > S. If both sides of equation (C-2) are 
squared, and the resulting equation is solved for S , 


S 


i ± n/i - (i - r s 2 /3 2 )(i - y R 2 p 2 )' 


(C-3) 


Interest is usually in positive values of p, and S and R are defined as positive 
real quantities. Note that the denominator of equation (C-3) is always less than 
unity. Therefore, if R is to be greater than S as must be the case for positive 
p, the numerator in brackets must also be less than unity. This implies that the 
minus sign must always be chosen in front of the radical. 


_ _ i - - r R 2 P 2 f 

s ' fi ~ ' - 


(C-4) 


Now, beginning with an assumed test option (which uniquely determines 
R and y ), an assumed value of y , and an assumed positive value of p, S can 
be calculated from equation (C-4) . If a normal distribution of the applied load 
is assumed, then sufficient information is now available to evaluate the integral 
equation (7. 6) of Chapter VII and plot one point on the p f (k) versus p curves. 
Next, additional values of (3 are assumed with the other parameters held fixed, 
and several points are plotted to establish one curve. These computations are 
easily carried out on a hand calculator or a small computer. 

Once S has been determined from equation ( C-4) , the safety factor v 
consistent with the assumed value for p can be determined from equation (4. 20) 
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of Chapter IV. To do this, a value of q must be selected, and a value of 3. 0 
was selected for q for all numerical computations in this dissertation. The 
results of the parametric calculations are shown in Figures 33 through 38. 


T 2 3 4 S 1 2 3 4 5 

SAFETY INDEX, 0 SAFETY INDEX, 0 

b. Test Option T t . c. Test Option T 3 . 

Figure 33. Relationship of Safety Factor and Safety Index. 




2.0 3.0 

SAFETY INDEX, $ 


a. y = 0. 05787. 
S 


Figure 34. Probability of Failure versus Safety Index for 
Test Options 0, 1, and 3. 
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a. y g = 0. 05787. 

Figure 35. Probability of Failure versus Safety Index for 

Test Option 2. 



3„0 4.0 5.0 6.0 

SAFETY INDEX, & 

b. 7g = 0. 12916. 

Figure 35. (Continued). 




c. y^ = 0. 37. 
Figure 35. (Concluded). 
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a. y 0 = 0. 05787. 
b 

Figure 36. Probability of Failure versus Safety Factor for 
Test Options 0, 1, and 3. 
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b. y Q = 0. 12916. 
Figure 36. (Continued). 
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c. y g = 0.37. 
Figure 36. (Concluded). 
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a. y = 0. 05787. 

O 


Figure 37. Probability of Failure versus Safety Factor for Test Option 2. 
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c. 7g = 0.37. 
Figure 37, (Concluded). 
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Figure 38. Probability of Failure versus Proof Test Level 
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APPENDIX D 
SAMPLE CALCULATIONS 

To illustrate the method used for plotting the cost optimization curves. 
Figures 27 through 32 in Chapter VIL1, sample calculations will be performed in 
this appendix for two of the sample problems. This is accomplished by applying 
the equations of Chapter VII to data for the example problems in Table 9. 

D. 1 Procedure 

A step-by-step procedure for calculating one point in the cost optimiza- 
tion curves will be given. 

1. List the input data from Table 9: c , C , C , C , y , n, m. 

W Jr J? JJ. u 

p J 

2. Assume a value of fi. 

3. From Figure 33, read the corresponding value of v for the appro- 
priate test option and y s . 

4. From the appropriate Figures 21 through 26, read the weight value 
corresponding to v from step 3. 

5. Determine W(/3) by subtracting the baseline weight from the weight 
determined in step 4. The baseline weight may be selected arbitrarily and the 
expected cost will then be relative to this arbitrary baseline. In the examples 
in this dissertation* baseline weights corresponding to v - 1.4 were used 
except for the S-II forward skirt, where v -1,3 was used. 
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6. Calculate the cost of weight, C w = c^ W(j3), equation (7. 18). W(j3) 

is from step 5, and c is from the input data. 

w 

7. Read p^(k) from the appropriate Figures 34 through 38. 

8. If the calculation is for the proof test option, determine 


P f (p ) = F R (r 0 ) = 




6.43 


from equation (4. l) . 


9. Calculate the expected cost of failure, C = C n p (k) + C m p (p) 

r F I F I 

P 

from equation (7.31). C and C are input data, and p f (k) and p (p) are 

p 1 f 


from steps 7 and 8 C 

10o Calculate the total expected cost for this example problem from 

equation (7.32), using (direct costs) from the input data, from step 

j ^ 

6, and C from step 9: C.(£) = C + C + C . 

r j D , W _b 


11. Plot a point on the expected cost versus (3 curve using the assumed 
value of |3 from step 2 and C.(j3) from step 10. Plot a point on the expected 
cost versus v curve using the value of v from step 3 and C.(j3) from step 10. 


D. 2 Sample Calculation for S-IVB Af t Skirt 

A sample calculation for test option T 2 with r 0 = 60 will be made for the 

S-IVB aft skirt using the procedure outlined in section D. 1. 

1. Input data from Table 9: c w = 11,500 dollars per pound, C R = 

250 x 10 6 dollars, C^ = 0.72 x 10 6 dollars, C^ = 3.28 x 10 6 dollars, = 

F S 


0. 12916, n = 15, and m = 15. 
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2 0 Assume that j3 = 3. 00. 

3. Read v - 1„ 57 from Figure 33a for 0 =3.00 and y = 0. 12916. 

s 

4. From Figure 21, the S-IVB aft skirt weight for v = 1.57 is 
W(£= 1.57) = 1920 lb. 

5. W(j3) = W(^ = 1. 57) - W(^ = 1. 4) = 1920 - 1815 = 105 lb. 

6. C w = c w W(/3) = 11, 500 ( 105) = 1, 208, 000 dollars. 

7. From Figure 35b, p f (k) = 3. 2 x 10“ 5 . 

/ 60 \ 6 * 43 

8. P f (p) = f r ( 60) = 1 - e \ 115 ' 5 / = 0.01472. 

9. C F = C F np f (k) +C F mp f (p) = (250 x 10 6 ) (15) ( 3.2 X 10~5) 

P 

+ (0. 72 X 10 6 ) (15) (0 . 01472) = 279 , 000 dollars. 

10. C (3. 00) = C +C„=C_ =3,280,000 + 1,208,000 +279,000 

2 D. W r 

J 

= 4, 767, 000 dollars. 

11. The result from step 10 is plotted in Figure 27a as points A and B. 

D, 3. Sample Calculation for E T Intertank 
A sample calculation for test option will be made for the ET intertank. 

1. Input data from Table 9: = 13,706 dollars per pound, C F = 

125 x 10 6 dollars, = 2. 0 x 10 6 dollars, y = 0. 05787, n = 445, and m = 445. 

S 

2. Assume that 0 = 4. 00. 

3. From Figure 33, v = 1. 53 for /3 = 4. 00, and yg = 0. 05787. 

4. From Figure 23, W (v = 1.53) = 12,600 lb. 
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5. W(/3) = W(v = 1. 53) - W(v = 1.4) = 12, 600 - 11, 600 = 1, 000 lb. 

6. C =c W(j3) = 13,706 ( 1,000) = 13,706,000 dollars. 

w w 

7. From Figure 34, p^(k) = 5. 2 x 10 -4 for /3 =4.00, test option Tj. 

8. Not applicable for test option Tj. 

9. ~C = C n p (k) = 125 X 10 6 (445) (5.2 x 10" 4 ) = 28.925 X 10 6 

F F I 

dollars . 

10. C (4. 00) = C_ +C + = 2,000,000 + 13,706,000 + 28,925,000 

1 v t d w F 

J 

= 44,631, 000 dollars. 

11. The result from step 10 is plotted as points C and D in Figure 29b. 
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